feat(ift): EventHub AI Router stack for Zed

FastAPI gateway with A/B/C lane orchestration, LiteLLM proxy config,
Swarm stack (postgres, redis, VPN off-by-default), deploy/smoke/audit scripts.

watchdog/Dockerfile

@@ -0,0 +1,8 @@
+FROM docker:27-cli
+
+RUN apk add --no-cache curl bash
+
+COPY vpn-watchdog.sh /usr/local/bin/vpn-watchdog.sh
+RUN chmod +x /usr/local/bin/vpn-watchdog.sh
+
+CMD ["/usr/local/bin/vpn-watchdog.sh"]

watchdog/vpn-watchdog.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# End-to-end VPN tunnel probe; restart vless-proxy on failure
+set -euo pipefail
+
+STACK_NAME="${STACK_NAME:-ai-router}"
+VLESS_PROXY_URL="${VLESS_PROXY_URL:-http://vless-proxy:8080}"
+CHECK_INTERVAL="${CHECK_INTERVAL:-60}"
+
+log() { echo "[vpn-watchdog] $(date -Iseconds) $*"; }
+
+while true; do
+  if curl -sf -x "${VLESS_PROXY_URL}" --max-time 15 https://www.google.com/generate_204 >/dev/null 2>&1; then
+    log "tunnel OK"
+  else
+    log "tunnel FAIL — force restart ${STACK_NAME}_vless-proxy"
+    docker service update --force "${STACK_NAME}_vless-proxy" || log "service update failed"
+  fi
+  sleep "${CHECK_INTERVAL}"
+done