fix(sgx): move LiteLLM off port 4000 to avoid uptime-kuma clash

Uptime Kuma already binds 4000, so the gateway never got the port and
requests hit the wrong service. Move LiteLLM to 4001 and update the rag
CLI default endpoint to match.

systems/x86_64-linux/sgx/litellm.nix

@@ -6,7 +6,7 @@
   services.litellm = {
     enable = true;
     host = "0.0.0.0";
-    port = 4000; # 8080 is Open WebUI, 8081 is searx
+    port = 4001; # 8080 Open WebUI, 8081 searx, 4000 uptime-kuma
     openFirewall = true; # reachable across the LAN
     environmentFile = config.sops.secrets."litellm/env".path;