refactor(svc-ai-litellm): read the canonical database url and volume target

DATABASE_URL was assembled by hand from five separate database lookups and
string concatenation. That form cannot encode special characters: a password
containing @ or / takes the URL apart. Read
lookup('database', application_id, 'url_full') instead, which the lookup
documents for exactly this.

LITELLM_CONFIG_PATH_DOCKER hardcoded /etc/litellm/config.yaml although
meta/volumes.yml already declares the litellm_config volume. Read its target
so the declaration and its use cannot drift.

Both lookups are established: url_full is documented in database.py and
lookup('volume', ...) is used by 51 roles. litellm ran on these lines
throughout the session, reaching postgres, issuing virtual keys and serving
completions. The evidence is that it worked, not a value-by-value comparison
of the two url forms.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/svc-ai-litellm/templates/env.j2

@@ -1,7 +1,7 @@
 {% include 'roles/sys-svc-container/templates/env.j2' %}
 
 LITELLM_MASTER_KEY={{ LITELLM_MASTER_KEY | dotenv_quote }}
-DATABASE_URL={{ ('postgresql://' ~ lookup('database', application_id, 'username') ~ ':' ~ lookup('database', application_id, 'password') ~ '@' ~ lookup('database', application_id, 'host') ~ ':' ~ lookup('database', application_id, 'port') ~ '/' ~ lookup('database', application_id, 'name')) | dotenv_quote }}
+DATABASE_URL={{ lookup('database', application_id, 'url_full') | dotenv_quote }}
 STORE_MODEL_IN_DB=False
 UI_USERNAME={{ lookup('users', 'administrator').username }}
 UI_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.ui_password') | dotenv_quote }}

roles/svc-ai-litellm/vars/main.yml

@@ -6,5 +6,5 @@ LITELLM_CONTAINER: "{{ lookup('config', application_id, 'services.litellm.name')
 LITELLM_PORT: "{{ lookup('config', application_id, 'services.litellm.ports.internal.http') }}"
 LITELLM_MASTER_KEY: "{{ lookup('config', application_id, 'secrets.credentials.master_key') }}"
 LITELLM_CONFIG_PATH_HOST: "{{ [ lookup('container', application_id, 'directories.config'), 'config.yaml' ] | path_join }}"
-LITELLM_CONFIG_PATH_DOCKER: "/etc/litellm/config.yaml"
+LITELLM_CONFIG_PATH_DOCKER: "{{ lookup('volume', application_id, 'litellm_config').target }}"
 LITELLM_OPENROUTER_API_KEY: "{{ OPENROUTER_API_KEY }}"