feat(langfuse): stand up Langfuse v3 + wire the LiteLLM trace callback

LLM observability for the fleet — pretty trace UI over the gateway: prompts,
completions, reasoning, latency, token counts. The pretty layer LiteLLM's
spend_logs lacked.

- stacks/langfuse: v3 self-host stack (web/worker/postgres/clickhouse/redis/
  minio) on ana-docker, adapted from upstream. UI on :3001 (gitea owns :3000).
  Project + API keys auto-provisioned via LANGFUSE_INIT_*. HOSTNAME=0.0.0.0 on
  langfuse-web so it's reachable via the published port while also on tnet.
- litellm: enabled success_callback/failure_callback: ["langfuse"] (the
  passthrough env was already wired); keys + host go in the litellm .env.

Verified: stack healthy, project keys authenticate, and a real gateway call
landed a litellm-acompletion trace in Langfuse within ~6s. Secrets live only in
the server .env (never committed).

stacks/litellm/conf/config.yaml

@@ -104,9 +104,9 @@ litellm_settings:
   # vLLM rejects some OpenAI params other backends accept; drop silently
   # rather than 400 the caller.
   drop_params: true
-  # --- Langfuse-ready: uncomment to ship full traces to a Langfuse
-  #     instance (set LANGFUSE_PUBLIC_KEY / LANGFUSE_SECRET_KEY /
-  #     LANGFUSE_HOST in .env). This is the entire upgrade — the gateway
-  #     and every consumer stay pointed here. ---
-  # success_callback: ["langfuse"]
-  # failure_callback: ["langfuse"]
+  # --- Langfuse trace export (live 2026-06-05). Full prompt/completion +
+  #     reasoning + tok-derivable latency traces ship to the Langfuse stack on
+  #     ana-docker (project "gateway"). Keys + host in .env. The gateway and
+  #     every consumer stay pointed here — this callback is the whole upgrade. ---
+  success_callback: ["langfuse"]
+  failure_callback: ["langfuse"]