feat(llm-api): add CI/CD, Dockerfile, compose, Traefik routing

- infra/docker/llm-api.Dockerfile — multi-stage Rust build with cargo-chef
- infra/compose/llm-api.yml — service with model volume mount & healthcheck
- infra/traefik/dynamic/apps.yaml — router for ai.asepharyana.my.id
- CI: build-push workflow detects llm-api changes, builds image
- CD: deploy workflow includes llm-api.yml in compose stack

infra/docker/llm-api.Dockerfile

@@ -0,0 +1,45 @@
+# ── Build stage: cargo-chef ──
+FROM lukemathwalker/cargo-chef:latest-rust-1.89.0 AS chef
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libclang-dev cmake \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+
+FROM chef AS planner
+COPY apps/llm-api .
+RUN cargo chef prepare --recipe-path recipe.json
+
+FROM chef AS builder
+COPY --from=planner /app/recipe.json recipe.json
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo chef cook --release --recipe-path recipe.json
+
+COPY apps/llm-api .
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo build --release && \
+    cp target/release/llm-api /app/llm-api
+
+# ── Runtime image ──
+FROM debian:bookworm-slim AS runtime
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    libssl3 \
+    libgomp1 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd -g 1001 appgroup && \
+    useradd -u 1001 -g appgroup -s /bin/sh appuser
+
+WORKDIR /app
+COPY --from=builder /app/llm-api /app/llm-api
+
+# Model will be mounted at runtime
+RUN mkdir -p /root/models/gguf && chown -R appuser:appgroup /root/models/gguf
+
+USER appuser
+
+EXPOSE 8080
+CMD ["./llm-api"]