feat: LLM routing by tier (free→Ollama, pro→Timeweb)

- Add tier-based provider routing in llm-svc
  - free tier → Ollama (local qwen3.5:9b)
  - pro/business → Timeweb Cloud AI
- Add /api/v1/embed endpoint for embeddings via Ollama
- Update Ollama client: qwen3.5:9b default, remove auth
- Add GenerateEmbedding() function for qwen3-embedding:0.6b
- Add Ollama K8s deployment with GPU support (RTX 4060 Ti)
- Add monitoring stack (Prometheus, Grafana, Alertmanager)
- Add Grafana dashboards for LLM and security metrics
- Update deploy.sh with monitoring and Ollama deployment

Made-with: Cursor

backend/deploy/k8s/deploy.sh

@@ -22,6 +22,21 @@ if [ -f "$ENV_FILE" ]; then
   set +a
 fi
 
+# Check required secrets
+if [ -z "$OLLAMA_API_TOKEN" ]; then
+  echo "Warning: OLLAMA_API_TOKEN not set. Generating random token..."
+  OLLAMA_API_TOKEN=$(openssl rand -hex 32)
+  echo "OLLAMA_API_TOKEN=$OLLAMA_API_TOKEN" >> "$ENV_FILE"
+  echo "Token saved to .env"
+fi
+
+if [ -z "$GRAFANA_ADMIN_PASSWORD" ]; then
+  echo "Warning: GRAFANA_ADMIN_PASSWORD not set. Generating random password..."
+  GRAFANA_ADMIN_PASSWORD=$(openssl rand -base64 24)
+  echo "GRAFANA_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD" >> "$ENV_FILE"
+  echo "Grafana password saved to .env"
+fi
+
 # Check kubectl
 if ! command -v kubectl &> /dev/null; then
     echo "Error: kubectl not found"
@@ -62,6 +77,9 @@ echo "=== Generating K8s manifests from .env ==="
 if command -v envsubst &> /dev/null && [ -f "$ENV_FILE" ]; then
     envsubst < "$SCRIPT_DIR/configmap.yaml" > "$SCRIPT_DIR/_generated_configmap.yaml"
     kubectl apply -f "$SCRIPT_DIR/_generated_configmap.yaml" -n gooseek
+
+    # Generate monitoring manifests
+    envsubst < "$SCRIPT_DIR/monitoring.yaml" > "$SCRIPT_DIR/_generated_monitoring.yaml"
 fi
 
 # Apply kustomization
@@ -70,6 +88,14 @@ echo "=== Applying K8s manifests ==="
 cd "$SCRIPT_DIR"
 kubectl apply -k .
 
+# Apply monitoring stack
+echo ""
+echo "=== Deploying Monitoring Stack ==="
+if [ -f "$SCRIPT_DIR/_generated_monitoring.yaml" ]; then
+    kubectl apply -f "$SCRIPT_DIR/_generated_monitoring.yaml"
+    kubectl apply -f "$SCRIPT_DIR/grafana-dashboards.yaml"
+fi
+
 # Rolling restart to pull new images
 echo ""
 echo "=== Rolling restart deployments ==="
@@ -79,11 +105,16 @@ kubectl -n gooseek rollout restart deployment/chat-svc
 kubectl -n gooseek rollout restart deployment/agent-svc
 kubectl -n gooseek rollout restart deployment/discover-svc
 kubectl -n gooseek rollout restart deployment/search-svc
+kubectl -n gooseek rollout restart deployment/llm-svc
 kubectl -n gooseek rollout restart deployment/learning-svc
 kubectl -n gooseek rollout restart deployment/medicine-svc
 kubectl -n gooseek rollout restart deployment/travel-svc
 kubectl -n gooseek rollout restart deployment/sandbox-svc
 
+# Ollama: не рестартим без необходимости (модели хранятся на PVC)
+# Модели загружаются один раз и сохраняются между деплоями
+# Для загрузки новых моделей: kubectl apply -f ollama-models.yaml
+
 # Wait for rollout
 echo ""
 echo "=== Waiting for rollouts ==="
@@ -100,7 +131,18 @@ kubectl -n gooseek get svc
 echo ""
 kubectl -n gooseek get ingress
 
+# Show monitoring status
+echo ""
+echo "=== Monitoring Status ==="
+kubectl -n monitoring get pods 2>/dev/null || echo "Monitoring namespace not ready yet"
+kubectl -n monitoring get ingress 2>/dev/null || true
+
 echo ""
 echo "=== Done ==="
-echo "API: https://api.gooseek.ru"
-echo "Web: https://gooseek.ru"
+echo "API:     https://api.gooseek.ru"
+echo "Web:     https://gooseek.ru"
+echo "Grafana: https://grafana.gooseek.ru"
+echo ""
+echo "Grafana credentials:"
+echo "  User: admin"
+echo "  Pass: (see GRAFANA_ADMIN_PASSWORD in .env)"