feat(homelab): set flinker/qwen3.6-35b-a3b as default model with llama.cpp config

[mrsimpson]

Summary

• Set flinker/qwen3.6-35b-a3b as the default model for all new session pods
• Inject top_k=20, top_p=0.95, temperature=0.6 into the qwen model config for llama.cpp (per Qwen model card coding recommendations)
• Switch from Anthropic API keys to OpenRouter (free + paid tiers)
• Add dynamic model fetching from OpenRouter at deploy time
• Add attach service for router attach port (4096)
• Add admin secret for CI endpoints (e.g. /api/admin/pull-image)
• Update operator sidecar env vars (ROUTER_ADMIN_URL, attach config, admin secret)
• Change oauth2Proxy group from users to developers
• Route session traffic through Traefik for proper oauth2 middleware chain

Key Decisions

1. Default model — Root model field in dynamic ConfigMap's opencode.json
2. llama.cpp options — Per Qwen model card "Thinking mode for precise coding tasks": temperature=0.6, top_p=0.95, top_k=20. Injected via model.options in parseFlinkerModel for qwen3.6-35b-a3b only.
3. Provider switch — Anthropic → OpenRouter (free tier + 20 most-popular paid programming models)
4. Traefik routing — Session traffic now goes through Traefik to ensure ForwardAuth → oauth2-chain middleware runs

Changes

• deployment/homelab/src/index.ts — ConfigMap, providers, secrets, services, env vars
• .vibe/development-plan-feat-set-default-model-flinker-llama-cpp-config.md — Development plan