feat: add flexible docker-compose architecture with profiles

- Add OpenBao services to docker-compose.yml with profiles (openbao, full)
- Add docker-compose.build.yml for local builds vs registry pulls
- Make PostgreSQL and Valkey optional via profiles (database, cache)
- Create example compose files for common deployment scenarios:
  - docker/docker-compose.example.turnkey.yml (all bundled)
  - docker/docker-compose.example.external.yml (all external)
  - docker/docker.example.hybrid.yml (mixed deployment)
- Update documentation:
  - Enhance .env.example with profiles and external service examples
  - Update README.md with deployment mode quick starts
  - Add deployment scenarios to docs/OPENBAO.md
  - Create docker/DOCKER-COMPOSE-GUIDE.md with comprehensive guide
- Clean up repository structure:
  - Move shell scripts to scripts/ directory
  - Move documentation to docs/ directory
  - Move docker compose examples to docker/ directory
- Configure for external Authentik with internal services:
  - Comment out Authentik services (using external OIDC)
  - Comment out unused volumes for disabled services
  - Keep postgres, valkey, openbao as internal services

This provides a flexible deployment architecture supporting turnkey,
production (all external), and hybrid configurations via Docker Compose
profiles.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker/docker-compose.example.turnkey.yml

@@ -0,0 +1,43 @@
+# ==============================================
+# Mosaic Stack - Turnkey Deployment Example
+# ==============================================
+# This example shows a complete all-in-one deployment with all services bundled.
+# Ideal for local development, testing, and demo environments.
+#
+# Usage:
+#   1. Copy this file to docker-compose.override.yml (optional)
+#   2. Set COMPOSE_PROFILES=full in .env
+#   3. Run: docker compose up -d
+#
+# Or run directly:
+#   docker compose -f docker-compose.yml -f docker-compose.example.turnkey.yml up -d
+#
+# Services Included:
+#   - PostgreSQL 17 with pgvector
+#   - Valkey (Redis-compatible cache)
+#   - OpenBao (secrets management)
+#   - Authentik (OIDC authentication)
+#   - Ollama (local LLM)
+#   - Traefik (reverse proxy) - optional, requires traefik-bundled profile
+#   - API (NestJS)
+#   - Web (Next.js)
+#   - Orchestrator (Agent management)
+#
+# Environment Variables (.env):
+#   COMPOSE_PROFILES=full
+#   IMAGE_TAG=dev  # or latest
+#
+# All services run in Docker containers with no external dependencies.
+# ==============================================
+
+services:
+  # No service overrides needed - the main docker-compose.yml handles everything
+  # This file serves as documentation for turnkey deployment
+  # Set COMPOSE_PROFILES=full in your .env file to enable all services
+
+  # Placeholder to make the file valid YAML
+  # (Docker Compose requires at least one service definition)
+  _placeholder:
+    image: alpine:latest
+    profiles:
+      - never-used