hindsight: swap LLM astro-orbiter Qwen3.8-27B -> Nous free-tier stepfun/step-3.7-flash:free (t_90261bb1)

- values.yaml: HINDSIGHT_API_LLM_BASE_URL -> https://inference-api.nousresearch.com/v1, MODEL -> stepfun/step-3.7-flash:free (fallback solar-pro4:free documented, not deployed)
- externalsecret.yaml: HINDSIGHT_API_LLM_API_KEY remoteRef -> 1Password nous/api-key (replaces local-placeholder)
- PROVIDER stays openai; API key via envFrom, never plaintext per decision 4

cluster/applications/hindsight/externalsecret.yaml

@@ -69,9 +69,11 @@ spec:
       remoteRef:
         key: hindsight
         property: HINDSIGHT_API_MCP_AUTH_TOKEN
-    # 1Password item "hindsight", field "HINDSIGHT_API_LLM_API_KEY"
-    # (literal "local-placeholder" — astro-orbiter does not validate, D1)
+    # 1Password item "nous" (vault mk-labs), field "api-key" (Ryan-provisioned,
+    # decision 4). Replaces the prior "local-placeholder" value — astro-orbiter
+    # did not validate; now wired to the Nous free-tier inference API. Materialized
+    # Secret key name stays HINDSIGHT_API_LLM_API_KEY (env-var-named, envFrom).
     - secretKey: HINDSIGHT_API_LLM_API_KEY
       remoteRef:
-        key: hindsight
-        property: HINDSIGHT_API_LLM_API_KEY
+        key: nous
+        property: api-key

cluster/applications/hindsight/values.yaml

@@ -12,9 +12,12 @@
 #     HINDSIGHT_API_LLM_API_KEY / HINDSIGHT_API_MCP_AUTH_TOKEN are injected
 #     automatically; POSTGRES_PASSWORD is a secretKeyRef that K8s expands into
 #     HINDSIGHT_API_DATABASE_URL (verified with a live envFrom test pod).
-#   - LLM is the local OpenAI-compatible astro-orbiter endpoint (VLAN service
-#     `astro-orbiter:8001`), model pinned to the bare id (no `openai/` prefix —
-#     that form 404s on the local router).
+#   - LLM is the Nous free-tier inference endpoint
+#     (https://inference-api.nousresearch.com/v1), model
+#     `stepfun/step-3.7-flash:free` (mandatory reasoning, 262K ctx). Fallback
+#     (documented, NOT deployed): `solar-pro4:free`. API key via existingSecret
+#     envFrom (hindsight-credentials / HINDSIGHT_API_LLM_API_KEY), sourced from
+#     1Password `nous` item per decision 4.
 #   - Ingress is driven through the chart's NATIVE ingress template (approved
 #     plan: "Ingress driven through values.yaml"). api.service.port=8888,
 #     controlPlane.service.port=3000.
@@ -46,15 +49,16 @@ existingSecret: hindsight-credentials
 
 # ----------------------------------------------------------------------------
 # API container environment (explicit env entries; the chart renders this map
-# to individual env vars). LLM points at the local astro-orbiter OpenAI-
-# compatible server. HINDSIGHT_API_LLM_API_KEY is NOT set here — it comes from
-# the existingSecret via envFrom.
+# to individual env vars). LLM points at the Nous free-tier inference API
+# (OpenAI-compatible). HINDSIGHT_API_LLM_API_KEY is NOT set here — it comes from
+# the existingSecret via envFrom (1Password `nous` item).
 # ----------------------------------------------------------------------------
 api:
   env:
-    HINDSIGHT_API_LLM_BASE_URL: "http://astro-orbiter:8001/v1"
+    HINDSIGHT_API_LLM_BASE_URL: "https://inference-api.nousresearch.com/v1"
     HINDSIGHT_API_LLM_PROVIDER: "openai"
-    HINDSIGHT_API_LLM_MODEL: "Qwen3.8-27B-Q4_K_M"
+    # Primary LLM. Fallback (documented, NOT deployed): solar-pro4:free
+    HINDSIGHT_API_LLM_MODEL: "stepfun/step-3.7-flash:free"
 
 # ----------------------------------------------------------------------------
 # Ingress via the chart's native template.