feat(sgx): add CLI RAG stack (Qdrant + embeddings gateway + rag tool)

Stand up document retrieval as shared, client-agnostic primitives rather
than locking it inside Open WebUI:

- Qdrant as the LAN-reachable vector store
- LiteLLM gains a bge-m3 route so sgx:4000 also serves /v1/embeddings
- a thin `rag` CLI (ingest/query, optional coder synthesis) usable from
  any machine and from scripts

Embeddings and synthesis run on halo via the gateway; the CLI is
configured entirely through RAG_* env vars.

systems/x86_64-linux/sgx/default.nix

@@ -12,6 +12,7 @@
     ./wyoming.nix
     ./searx.nix
     ./litellm.nix
+    ./qdrant.nix
     ./uptime-kuma.nix
     ./firefly.nix
     ./opencode.nix
@@ -25,6 +26,7 @@
   environment.systemPackages = with pkgs; [
     claude-code
     opencode
+    metacfg.rag
   ];
 
   services.tailscale.enable = true;