feat(ai): unify AI architecture, implement RAG and legacy migration

backend/.env.example

@@ -32,9 +32,20 @@ CLAMAV_HOST=localhost
 CLAMAV_PORT=3310
 
 # ========================================
-# ADR-022 RAG — Retrieval-Augmented Generation
+# ADR-023 Unified AI Architecture
 # ========================================
 
+# Isolated AI Host (Desk-5439)
+AI_HOST_URL=http://192.168.10.100:11434
+AI_QDRANT_URL=http://192.168.10.100:6333
+AI_N8N_WEBHOOK_URL=http://192.168.10.100:5678/webhook/lcbp3-ai
+AI_N8N_SERVICE_TOKEN=change-me-service-token
+AI_TIMEOUT_MS=30000
+AI_MAX_RETRIES=3
+
+# Legacy aliases kept during ADR-023 migration
+AI_N8N_AUTH_TOKEN=change-me-service-token
+
 # Qdrant vector store (local docker-compose or QNAP)
 QDRANT_URL=http://localhost:6333
 
@@ -46,9 +57,7 @@ OLLAMA_URL=http://192.168.10.100:11434
 # Thai preprocessing microservice (PyThaiNLP — Admin Desktop)
 THAI_PREPROCESS_URL=http://192.168.10.100:8765
 
-# Typhoon API (cloud LLM — PUBLIC/INTERNAL only, never CONFIDENTIAL)
-TYPHOON_API_KEY=your-typhoon-api-key-here
-TYPHOON_API_URL=https://api.opentyphoon.ai/v1
+# ADR-023 forbids cloud AI fallback for project documents.
 
 # RAG query config
 RAG_TOPK=20