feat(chat): replace built-in chat with LibreChat SSO integration

Replaces the custom chat page with an external LibreChat instance that
shares Keycloak SSO for seamless auto-login. Removes Tools and Knowledge
Base pages as these are now handled by LibreChat's built-in capabilities.

- Add LibreChat service to docker-compose with Ollama backend config
- Add Keycloak OIDC client (certifai-librechat) with prompt=none for
  silent SSO
- Create librechat.yaml with CERTifAI branding, Ollama endpoint, and
  custom page title/logo
- Change sidebar Chat link to external URL (opens LibreChat in new tab)
- Remove chat page, tools page, knowledge base page and all related
  components (chat_sidebar, chat_bubble, chat_input_bar, etc.)
- Remove tool_card, file_row components and tool/knowledge models
- Remove chat_stream SSE handler (no longer needed)
- Clean up i18n files: remove chat, tools, knowledge sections
- Dashboard article summarization via Ollama remains intact

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -40,4 +40,45 @@ services:
     environment:
       - SEARXNG_BASE_URL=http://localhost:8888
     volumes:
-      - ./searxng:/etc/searxng:rw
+      - ./searxng:/etc/searxng:rw
+
+  librechat:
+    image: ghcr.io/danny-avila/librechat:latest
+    container_name: certifai-librechat
+    restart: unless-stopped
+    ports:
+      - "3080:3080"
+    depends_on:
+      keycloak:
+        condition: service_healthy
+      mongo:
+        condition: service_started
+    environment:
+      # MongoDB (shared instance, separate database)
+      MONGO_URI: mongodb://root:example@mongo:27017/librechat?authSource=admin
+      # Keycloak OIDC SSO
+      OPENID_ISSUER: http://localhost:8080/realms/certifai
+      OPENID_CLIENT_ID: certifai-librechat
+      OPENID_CLIENT_SECRET: certifai-librechat-secret
+      OPENID_CALLBACK_URL: /oauth/openid/callback
+      OPENID_SCOPE: openid profile email
+      OPENID_BUTTON_LABEL: Login with CERTifAI
+      OPENID_AUTH_EXTRA_PARAMS: prompt=none
+      # Disable local auth (SSO only)
+      ALLOW_EMAIL_LOGIN: "false"
+      ALLOW_REGISTRATION: "false"
+      ALLOW_SOCIAL_LOGIN: "true"
+      ALLOW_SOCIAL_REGISTRATION: "true"
+      # App settings
+      APP_TITLE: CERTifAI Chat
+      CUSTOM_FOOTER: CERTifAI - Sovereign GenAI Infrastructure
+      HOST: 0.0.0.0
+      PORT: "3080"
+      NO_INDEX: "true"
+    volumes:
+      - ./librechat/librechat.yaml:/app/librechat.yaml:ro
+      - ./librechat/logo.svg:/app/client/public/assets/logo.svg:ro
+      - librechat-data:/app/data
+
+volumes:
+  librechat-data: