paperless-ai: deploy clusterzx/paperless-ai for semantic doc search + AI tagging

Viktor wanted real semantic search over his ~300 Paperless documents and
preferred a ready-made solution over building one. paperless-ai provides
local-embedding RAG (ChromaDB + sentence-transformers, GPU-free) plus
LLM-driven auto-analysis/tagging.

Wiring:
- LLM (chat answers + tagging) -> in-cluster llama-swap qwen3-8b
  (OpenAI-compatible); embeddings + vector store are local on the PVC.
- Reads Paperless over the internal service via a dedicated `paperless-ai`
  superuser token (Vault secret/paperless-ai); app-admin creds also in Vault.
- Encrypted PVC for /app/data (SQLite + ChromaDB + model cache).
- Ingress paperless-ai.viktorbarzin.me behind Authentik (auth=required).
- Third-party image pinned (docker.io/clusterzx/paperless-ai:3.0.9), no Keel.

Runtime config persists to the PVC .env via the app's one-time setup; the
deployment env vars are pre-fill/documentation only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/paperless-ai/terragrunt.hcl

@@ -0,0 +1,26 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}
+
+dependency "vault" {
+  config_path  = "../vault"
+  skip_outputs = true
+}
+
+# Reads the Paperless API over the in-cluster service.
+dependency "paperless-ngx" {
+  config_path  = "../paperless-ngx"
+  skip_outputs = true
+}
+
+# LLM (chat/answer generation + auto-tagging) is served by llama-swap's
+# OpenAI-compatible endpoint; embeddings/semantic search are local in-pod.
+dependency "llama-cpp" {
+  config_path  = "../llama-cpp"
+  skip_outputs = true
+}