fix: harden compose Pi auth mounts

deploy/compose.server.yaml

@@ -8,6 +8,7 @@ services:
     volumes: !override
       - ${THT_DATA_ROOT:?set THT_DATA_ROOT}:/data
       - ${THT_PI_STATE_ROOT:?set THT_PI_STATE_ROOT}:/home/thoth/.pi
+      - ${PI_AUTH_FILE:?set PI_AUTH_FILE}:/home/thoth/.pi/agent/auth.json:ro
       - ${THT_WORKSPACE_REGISTRY_ROOT:?set THT_WORKSPACE_REGISTRY_ROOT}:/data/workspace-registry
     restart: unless-stopped
 

deploy/env/local.env.example

@@ -3,6 +3,7 @@
 THOTH_HTTP_PORT=8080
 THOTH_CORE_HTTP_PORT=8787
 MAX_PI_PROCESSES=4
+PI_AUTH_FILE=/absolute/path/to/pi-auth.json
 
 THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git
 THT_WORKSPACE_GIT_BRANCH=main
@@ -14,3 +15,4 @@ THT_DWH_REST_URL=https://dwh.example.invalid
 THT_VEC_REST_URL=https://vector.example.invalid
 THT_VEC_WRITE_REST_URL=https://vector-write.example.invalid
 THT_OLLAMA_URL=https://embeddings.example.invalid
+THT_LLM_URL=https://llm.example.invalid

deploy/env/server.env.example

@@ -3,6 +3,7 @@
 THOTH_SERVER_BIND=127.0.0.1
 THOTH_HTTP_PORT=8080
 MAX_PI_PROCESSES=4
+PI_AUTH_FILE=/absolute/path/to/pi-auth.json
 
 THT_DATA_ROOT=/srv/thothii/data
 THT_PI_STATE_ROOT=/srv/thothii/pi-state
@@ -17,3 +18,4 @@ THT_DWH_REST_URL=https://dwh.example.invalid
 THT_VEC_REST_URL=https://vector.example.invalid
 THT_VEC_WRITE_REST_URL=https://vector-write.example.invalid
 THT_OLLAMA_URL=https://embeddings.example.invalid
+THT_LLM_URL=https://llm.example.invalid