fix: add LLM_API_URL and LLM_MODEL to portfolio deployment

Problem: Portfolio pod had OAuth credentials (AUTHENTIK_CLIENT_ID/SECRET)
but was missing LLM_API_URL and LLM_MODEL environment variables.
Chat API could fetch tokens but had no endpoint to call.

Solution: Inject LLM configuration via k8s deployment env vars:
- LLM_API_URL: https://api.riotpiao.com/v1/chat/completions
- LLM_MODEL: qwen2.5:3b-instruct

Testing:
- Token fetch: ✓ portfolio-agent OAuth works
- DNS: ✓ api.riotpiao.com resolves (CoreDNS rewrite)
- Auth: ⚠️  JWT issuer mismatch (portfolio-agent vs api-gw) — separate issue

Impact: Chat API endpoint can now attempt LLM calls with valid auth

infra/portfolio/base/deployment.yaml

@@ -42,6 +42,11 @@ spec:
             secretKeyRef:
               name: portfolio-agent-oidc
               key: TOKEN_URL
+        # LLM API configuration
+        - name: LLM_API_URL
+          value: "https://api.riotpiao.com/v1/chat/completions"
+        - name: LLM_MODEL
+          value: "qwen2.5:3b-instruct"
         ports:
         - name: http
           containerPort: 3000