feat: add AI catalog description generation

docs/installazione-docker-4-contesti.md

@@ -42,6 +42,10 @@ cp deploy/env/local.env.example deploy/env/local.env
 cp deploy/secrets/thothii.secrets.example deploy/secrets/thothii.secrets
 chmod 600 deploy/secrets/thothii.secrets
 
+# Copy docs/install/examples/thothii-installation.local.yaml to a protected operator path,
+# replace every placeholder, chmod it 600, then set that exact path as
+# THT_INSTALLATION_CONFIG_SOURCE in deploy/env/local.env.
+
 docker compose --env-file deploy/env/local.env \
   -f compose.yaml -f deploy/compose.local.yaml up --build -d
 ```
@@ -50,6 +54,7 @@ Set these values in `deploy/env/local.env`:
 
 - `PI_AUTH_FILE`
 - `THT_SECRETS_FILE`
+- `THT_INSTALLATION_CONFIG_SOURCE` (the exact protected host `thothii-installation.yaml`)
 - `THT_WORKSPACE_GIT_REMOTE`
 - DWH endpoint
 - LLM endpoint
@@ -64,8 +69,20 @@ The documented and supported bundle keys are:
 ```dotenv
 THT_MODEL_API_KEY=...
 THT_DWH_API_KEY=...
+OPENAI_API_KEY=...
 ```
 
+`THT_MODEL_API_KEY` remains Pi-only. A metadata-generation model instead references one audited
+bundle name from `deploy/secrets/README.md` through `metadataGeneration.models[].apiKeyEnv`.
+`apiKeyEnv` may be omitted only for an explicit endpoint that accepts unauthenticated requests;
+hosted/default endpoints remain keyed.
+Provider/model/endpoint settings stay in the protected installation descriptor; raw keys do not.
+
+Compose mounts exactly `THT_INSTALLATION_CONFIG_SOURCE` into `core` as a read-only config and sets
+the backend-only runtime path `THT_INSTALLATION_CONFIG_FILE` to
+`/run/thothii-installation/thothii-installation.yaml`. Do not set the runtime path in the host env.
+Descriptor and bundle changes are loaded only after application restart.
+
 A private PEM CA remains outside the bundle and must be mounted through a reviewed Compose override.
 
 ## Preprocessing