feat(deploy): add portable external-service stack

deploy/env.example

@@ -0,0 +1,28 @@
+# Copy this file to deploy/.env. Never commit deploy/.env or real credentials.
+# Compose passes these values to the core container at runtime; images contain no secrets.
+
+# Optional application defaults
+PI_PROVIDER=
+PI_MODEL=
+PI_THINKING=
+MAX_PI_PROCESSES=4
+AUTH_MODE=none
+
+# External DWH (example workspace uses the HTTP adapters)
+THT_DB_NAME=
+THT_DWH_REST_URL=
+THT_DWH_API_KEY=
+
+# External vector service. Use a distinct write key where the service supports one.
+THT_VEC_REST_URL=
+THT_VEC_API_KEY=
+THT_VEC_WRITE_API_KEY=
+
+# External embeddings service
+THT_OLLAMA_URL=
+
+# Evidence source visible inside the persistent data volume
+THT_DOCS_ROOT=/data/workspaces/example/evidence-source
+
+# Optional CA file mounted separately by an operator, for example via a Compose override.
+THT_SSL_CA=