Add Docker containerization stack

- Dockerfile: multi-stage Python 3.13-slim, healthcheck, uvicorn CMD
- docker-compose.yml: full stack (cAIc, SearXNG, Qdrant, RabbitMQ,
  llama-server, Ollama) with healthchecks, volumes, secrets
- .dockerignore: exclude venv, tests, .git, models, secrets
- .env.example: all variables documented with generation hints
- scripts/setup.sh: first-run scaffolding (generates .env, secrets,
  SearXNG config, directories)
- searxng-settings.yml.dist: SearXNG config template
- models/README.txt: instructions for placing .gguf files
- config.py: add HW_STATE_PATH env var (CAIC_HW_STATE_PATH)
- hardware.py: read state path from config instead of hardcoded CWD
- requirements.txt: add missing psutil and jinja2

.env.example

@@ -0,0 +1,53 @@
+# ─────────────────────────────────────────────────────────────
+# cAIc — Environment configuration
+# Copy to .env and fill in values before running docker compose.
+# Secrets (lines marked 🔒) should be random — generate with:
+#   openssl rand -hex 20
+# ─────────────────────────────────────────────────────────────
+
+# ── Secrets ──────────────────────────────────────────────────
+# 🔒 Admin PIN (4 digits, required for first login)
+CAIC_ADMIN_PIN=
+CAIC_ALLOW_DEFAULT_PIN=false
+
+# 🔒 API key for IDE completions endpoint (auto-gen if empty)
+CAIC_COMPLETIONS_API_KEY=
+
+# 🔒 RabbitMQ password (must match secrets/rabbitmq_password.txt)
+RABBITMQ_PASSWORD=
+
+# 🔒 SearXNG session key
+SEARXNG_SECRET_KEY=
+
+# ── Service discovery (Docker service hostnames) ─────────────
+LLAMA_SERVER_BASE=http://llama-server:8081
+OLLAMA_BASE=http://ollama:11434
+CAIC_SEARXNG_BASE=http://searxng:8080
+CAIC_QDRANT_URL=http://qdrant:6333
+CAIC_EMBED_URL=http://ollama:11434
+CAIC_EMBED_MODEL=all-minilm:latest
+CAIC_AMQP_URL=amqp://caic:${RABBITMQ_PASSWORD}@rabbitmq:5672/caic
+
+# ── llama-server settings ────────────────────────────────────
+# Set this to your .gguf filename (must exist in ./models/)
+LLAMA_MODEL=
+LLAMA_CTX_SIZE=4096
+LLAMA_N_GPU_LAYERS=0
+LLAMA_RPC_ENDPOINTS=
+
+# ── RAG / Qdrant ─────────────────────────────────────────────
+CAIC_RAG_COLLECTION=caic_rag
+CAIC_RAG_MAX_VECTORS=50000
+
+# ── Network / security ───────────────────────────────────────
+CAIC_ALLOWED_CIDRS=127.0.0.0/8,::1/128,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+CAIC_TRUSTED_ORIGINS=
+CAIC_TRUST_X_FORWARDED_FOR=false
+
+# ── Port overrides (host-side publish) ───────────────────────
+CAIC_EXPOSE_PORT=8080
+SEARXNG_EXPOSE_PORT=8888
+QDRANT_EXPOSE_PORT=6333
+RABBITMQ_EXPOSE_PORT=5672
+LLAMA_EXPOSE_PORT=8081
+OLLAMA_EXPOSE_PORT=11434