Stand up open-webui on dankclaw (quadlet, boot-persistent)

Replace the dead dankserver open-webui (bare container, :3000, pointed at a
dead :9090 backend) with a boot-persistent quadlet on dankclaw:
- CPU image (:main); dankclaw is CPU-only, so the :cuda image is wasted.
- Isolated on slirp4netns; publishes 3005 (3000 is Gitea's HTTP port).
- Default LLM backend is the local vLLM on 52625 (frank-default-large).
- Data persists under /home/dank/Containers/open-webui/data.
- Caddy route now proxies to the published LAN port (the container is not on
  Caddy's network).

Also corrects the model/port mapping in the docs: the live state (verified
2026-08-19) is frank-default-large on vLLM :52625 (dankclaw) and
frank-default-small on llama.cpp :7770 (dankserver) — the reverse of the
2026-08-17 note.

dankclaw/Caddyfile

@@ -31,11 +31,13 @@ comfyui.dankclaw.local {
 }
 
 # --- OpenWebUI ---
+# open-webui is a quadlet container on slirp4netns (isolated), so Caddy cannot
+# reach it by container name. Proxy to its published LAN port instead.
 chat.dankclaw.local {
 	basicauth {
 		dank $2a$14$REPLACE_WITH_HASH
 	}
-	reverse_proxy openwebui:8080
+	reverse_proxy 192.168.0.143:3005
 }
 
 # --- Hermes ---

dankclaw/open-webui/quadlet/open-webui.container

@@ -0,0 +1,32 @@
+# Quadlet unit: open-webui (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/open-webui.container
+# Unit name: open-webui.service (container name: open-webui)
+#
+# Chat UI for the LLM fleet. It runs on the CPU image (dankclaw is CPU-only, so
+# the :cuda image would waste a large pull for a GPU it cannot use) and points
+# its OpenAI connection at the live vLLM backend on this host
+# (host.containers.internal:52625, model frank-default-large). It is isolated on
+# slirp4netns and publishes 3005 (3000 is Gitea's HTTP port). Data persists under
+# /home/dank/Containers/open-webui/data. See docs/Dankclaw/OpenWebUI.md.
+
+[Unit]
+Description=open-webui chat UI container
+After=network.target
+
+[Container]
+ContainerName=open-webui
+Network=slirp4netns
+Image=ghcr.io/open-webui/open-webui:main
+PublishPort=3005:8080
+Environment=OPENAI_API_BASE_URL=http://host.containers.internal:52625
+Environment=ANONYMIZED_TELEMETRY=False
+Environment=DO_NOT_TRACK=True
+Volume=/home/dank/Containers/open-webui/data:/app/backend/data
+
+[Service]
+TimeoutStartSec=900
+Restart=always
+
+[Install]
+WantedBy=default.target