feat(chat): replace built-in chat with LibreChat SSO integration

Replaces the custom chat page with an external LibreChat instance that
shares Keycloak SSO for seamless auto-login. Removes Tools and Knowledge
Base pages as these are now handled by LibreChat's built-in capabilities.

- Add LibreChat service to docker-compose with Ollama backend config
- Add Keycloak OIDC client (certifai-librechat) with prompt=none for
  silent SSO
- Create librechat.yaml with CERTifAI branding, Ollama endpoint, and
  custom page title/logo
- Change sidebar Chat link to external URL (opens LibreChat in new tab)
- Remove chat page, tools page, knowledge base page and all related
  components (chat_sidebar, chat_bubble, chat_input_bar, etc.)
- Remove tool_card, file_row components and tool/knowledge models
- Remove chat_stream SSE handler (no longer needed)
- Clean up i18n files: remove chat, tools, knowledge sections
- Dashboard article summarization via Ollama remains intact

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

keycloak/realm-export.json

@@ -78,6 +78,39 @@
       "optionalClientScopes": [
         "offline_access"
       ]
+    },
+    {
+      "clientId": "certifai-librechat",
+      "name": "CERTifAI Chat",
+      "description": "LibreChat OIDC client for CERTifAI",
+      "enabled": true,
+      "publicClient": false,
+      "directAccessGrantsEnabled": false,
+      "standardFlowEnabled": true,
+      "implicitFlowEnabled": false,
+      "serviceAccountsEnabled": false,
+      "protocol": "openid-connect",
+      "secret": "certifai-librechat-secret",
+      "rootUrl": "http://localhost:3080",
+      "baseUrl": "http://localhost:3080",
+      "redirectUris": [
+        "http://localhost:3080/*"
+      ],
+      "webOrigins": [
+        "http://localhost:3080",
+        "http://localhost:8000"
+      ],
+      "attributes": {
+        "post.logout.redirect.uris": "http://localhost:3080"
+      },
+      "defaultClientScopes": [
+        "openid",
+        "profile",
+        "email"
+      ],
+      "optionalClientScopes": [
+        "offline_access"
+      ]
     }
   ],
   "clientScopes": [