feat(sgx): add CLI RAG stack (Qdrant + embeddings gateway + rag tool)

Stand up document retrieval as shared, client-agnostic primitives rather
than locking it inside Open WebUI:

- Qdrant as the LAN-reachable vector store
- LiteLLM gains a bge-m3 route so sgx:4000 also serves /v1/embeddings
- a thin `rag` CLI (ingest/query, optional coder synthesis) usable from
  any machine and from scripts

Embeddings and synthesis run on halo via the gateway; the CLI is
configured entirely through RAG_* env vars.

systems/x86_64-linux/sgx/litellm.nix

@@ -22,6 +22,16 @@
             api_key = "none"; # llama-server requires no key; value is ignored
           };
         }
+        {
+          # Multilingual embeddings, also served by halo's router (the `[bge-m3]`
+          # preset). Exposes /v1/embeddings on this gateway for the rag CLI.
+          model_name = "bge-m3";
+          litellm_params = {
+            model = "openai/bge-m3";
+            api_base = "http://halo:8000/v1";
+            api_key = "none";
+          };
+        }
       ];
 
       general_settings = {