feat(classifier): optional GigaChat-2-Lite hybrid tier classify

LLM classify via LiteLLM gigachat-classifier when heuristic confidence
is low. CLASSIFIER_MODE=heuristic|hybrid|llm. Metrics classifier_source.

scripts/deploy.sh

@@ -36,6 +36,7 @@ ensure_secret router_api_key "${ROUTER_API_KEY:?ROUTER_API_KEY required}"
 ensure_secret postgres_password "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD required}"
 ensure_secret groq_api_key "${GROQ_API_KEY:-}"
 ensure_secret gemini_api_key "${GEMINI_API_KEY:-}"
+ensure_secret gigachat_credentials "${GIGACHAT_CREDENTIALS:-}"
 
 if [[ ! -f vless/vless.conf ]]; then
   echo "WARN: vless/vless.conf missing — stub for secret (VPN off until configured)"

scripts/litellm-entrypoint.sh

@@ -23,6 +23,9 @@ fi
 if [ -f /run/secrets/gemini_api_key ]; then
   export GEMINI_API_KEY="$(read_secret /run/secrets/gemini_api_key)"
 fi
+if [ -f /run/secrets/gigachat_credentials ]; then
+  export GIGACHAT_CREDENTIALS="$(read_secret /run/secrets/gigachat_credentials)"
+fi
 if [ -f /run/secrets/postgres_password ]; then
   export POSTGRES_PASSWORD="$(read_secret /run/secrets/postgres_password)"
   export DATABASE_URL="postgresql://${POSTGRES_USER:-litellm}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-litellm}"