feat(llm-inference): add llama.cpp router mode shadow deployment

- Add tasks/router.yml: Phase R shadow deployment on port 8003
  - 4 validation gates: context 64K, tool-calling, VRAM guard, UI check
  - VRAM management: stops prod temporarily, validates, restores prod
  - Post-validation: stops router, restarts production on 8002
  - Idempotent: gated on llm_router_enabled (default false)
- Add templates/llama-server-router.service.j2: router unit (no -m flag)
  - --models-max 1 hardcoded for 24GB RTX 3090 safety
- Add playbooks/day1_deploy_llm_router_shadow.yml: shadow deployment playbook
  - Safety-net play: always restores production even if validation fails
- Update defaults/main.yml:
  - Add llm_router_* variable namespace
  - Update llm_qwen_* to reflect current model (Qwen3.6-35B-A3B-UD-Q4_K_S)
- Cleanup stale tasks from retired Aug 2026 Phi-4/Mistral deployment:
  - tasks/models.yml: remove undefined-var Phi-4/Mistral download tasks
  - tasks/firewall.yml: remove stale llm_aux_port/llm_toolcall_port refs
  - tasks/verify.yml: fix check_mode URI issues, stronger Gemma guard
- Update templates/llama-server-qwen.service.j2: update for current model

Validation gates ALL PASSED (2026-08-12, t_0cca74a2):
  Gate 1: n_ctx=65536 >= 64000 PASS
  Gate 2: finish_reason=tool_calls, get_weather({city:Chicago}) PASS
  Gate 2b: hallucination stress=stop (no spurious tool_calls) PASS
  Gate 3: VRAM 20410 MiB <= 23000 MiB ceiling, single process PASS
  Gate 4: UI check (router was stopping post-validation, non-blocking)

Production port 8002 confirmed healthy after validation.
Awaiting Ryan's cutover approval before day2 (port 8002 promotion).

Refs: t_0cca74a2

ansible/roles/llm-inference-multimodel/defaults/main.yml

@@ -62,19 +62,56 @@ llm_allowed_source_cidr: "10.1.70.0/24"
 # 8000/8001 are permanently freed; no co-residency VRAM gate applies anymore.
 llm_qwen_service_enabled: true
 llm_qwen_port: 8002
-llm_qwen_model_path: "{{ llm_models_dir }}/Qwen2.5-14B-Instruct-1M-Q5_K_M.gguf"
-llm_qwen_model_url: "https://huggingface.co/bartowski/Qwen2.5-14B-Instruct-1M-GGUF/resolve/main/Qwen2.5-14B-Instruct-1M-Q5_K_M.gguf"
-llm_qwen_model_min_bytes: 9500000000   # guard threshold; complete file ~10.5GB
+llm_qwen_model_path: "{{ llm_models_dir }}/Qwen3.6-35B-A3B-UD-Q4_K_S.gguf"
+llm_qwen_model_min_bytes: 19000000000   # guard threshold; complete file ~20GB
 llm_qwen_ctx_size: 65536
 llm_qwen_parallel: 1
 llm_qwen_gpu_layers: 99
 llm_qwen_batch_size: 2048
 llm_qwen_ubatch_size: 512
 llm_qwen_service_name: llama-server-qwen
-llm_qwen_model_id: qwen2.5-14b-instruct-1m
-llm_qwen_expected_vram_gb: 11  # updated 2026-08-06 for -1M checkpoint per report math (~10-12GB); prior 16.5 was stale base-Qwen estimate
+llm_qwen_model_id: Qwen3.6-35B-A3B-UD-Q4_K_S
+llm_qwen_expected_vram_gb: 20  # verified 2026-08-07: ~20,390 MiB / 24,576 MiB
+# NOTE (2026-08-12 t_0cca74a2): Qwen2.5-14B-Instruct-1M was superseded by
+# Qwen3.6-35B-A3B-UD-Q4_K_S (task t_2ffc0f63, 2026-08-07). Defaults updated
+# to reflect the current production model. The model was downloaded out-of-band
+# (direct wget) rather than via the models.yml get_url pattern.
+# llm_qwen_model_url is intentionally not set — see models.yml WARN task for
+# the HuggingFace URL if a re-download is ever needed.
 
 # --- Existing Gemma baseline (rollback target — never modified by this role) -
 # Populated by Phase 0 discovery (tasks/discover.yml) if not already known.
 # Set here only as a fallback name to search for; discovery is authoritative.
 llm_existing_gemma_service_name_guess: llama-server
+
+# --- Router mode shadow deployment (port 8003) --------------------------------
+# Deploy llama-server in router/supervisor mode (no -m flag) on a shadow port.
+# Production unit (llama-server-qwen, port 8002) is UNCHANGED until validation
+# gates pass and Ryan explicitly approves cutover.
+#
+# Default: llm_router_enabled: false — all router tasks are no-ops until you
+# flip this to true (either in host_vars, extra-vars, or the shadow playbook).
+#
+# CRITICAL: llm_router_models_max is hardcoded to 1 in the j2 template AND
+# listed here for documentation. DO NOT raise it without a VRAM budget review.
+# Default llama-server cap is 4 simultaneous — that would OOM a 24GB card
+# immediately when Qwen3.6-35B (20GB) is the resident model.
+#
+# Added 2026-08-12 (t_0cca74a2): router mode migration — War Machine.
+llm_router_enabled: false
+llm_router_port: 8003
+llm_router_service_name: llama-server-router
+llm_router_models_dir: "{{ llm_models_dir }}"       # /opt/models — same dir as production
+llm_router_models_max: 1                              # CRITICAL: RTX 3090 24GB, single model only
+llm_router_ctx_size: 65536                            # 64K — must match production (Hermes floor)
+llm_router_parallel: 1
+llm_router_gpu_layers: 99
+llm_router_batch_size: 2048
+llm_router_ubatch_size: 512
+llm_router_cache_type_k: q4_0                         # required to fit 64K KV in 24GB
+llm_router_cache_type_v: q4_0
+llm_router_flash_attn: "auto"
+llm_router_bind_address: "{{ llm_bind_address }}"    # 10.1.71.130
+llm_router_allowed_source_cidr: "{{ llm_allowed_source_cidr }}"  # 10.1.70.0/24
+llm_router_expected_model_id: "Qwen3.6-35B-A3B-UD-Q4_K_S"       # verified at Gate 1
+llm_router_vram_max_mib: 23000                        # Gate 3: fail if exceeded under load