feat(openclaw): upgrade fleet to DeepSeek V4.1 Flash 1017 and harden operations

- Upgrade OpenClaw primary model from deepseek-v4.1-flash to deepseek-v4.1-flash-1017 across all interactive agents, heartbeats, compaction, and cron jobs.
- Configure hardened OpenRouter provider routing for 1017 (deepinfra, inference-net, parasail, cloudflare) with strict fp8/bf16 quantization and tool_choice verification.
- Retain deepseek-v4.1-flash (0910), z-ai/glm-5.3-flash, and qwen3.8-flash in the automated fallback chain.
- Update ADR 0002 with 1017 economics (30% price reduction on prompt/cache, +60% intelligence benchmark increase) and a 7-point provider qualification playbook.
- Add operational scripts and tooling for session compaction, subagent vector deduplication, gateway preflight, and triage diagnostics in k8s/openclaw.
- Update DuckDB backend engine, git-sync logic, and test suites.
- Enhance Mila tracking UI components and add container build configuration.
- Sync Terraform infrastructure state for Authentik.

terraform/infrastructure/authentik.tf

@@ -376,6 +376,23 @@ resource "authentik_application" "hosting_family" {
   protocol_provider = authentik_provider_proxy.hosting_family.id
 }
 
+# 11. Family Portal (family.haumdaucher.de)
+resource "authentik_provider_proxy" "family_portal" {
+  name                  = "Family Portal"
+  external_host         = "https://family.haumdaucher.de"
+  mode                  = "forward_single"
+  authorization_flow    = data.authentik_flow.default_authorization_flow.id
+  invalidation_flow     = data.authentik_flow.default_invalidation_flow.id
+  intercept_header_auth = true
+  access_token_validity = "days=30"
+}
+
+resource "authentik_application" "family_portal" {
+  name              = "Family Portal"
+  slug              = "family-portal"
+  protocol_provider = authentik_provider_proxy.family_portal.id
+}
+
 # --- Outpost: Embedded Proxy Outpost ---
 
 resource "authentik_outpost" "embedded" {
@@ -392,6 +409,7 @@ resource "authentik_outpost" "embedded" {
     authentik_provider_proxy.n8n.id,
     authentik_provider_proxy.silverbullet.id,
     authentik_provider_proxy.hosting_family.id,
+    authentik_provider_proxy.family_portal.id,
   ]
 }
 
@@ -789,6 +807,18 @@ resource "authentik_policy_binding" "hosting_family_family" {
   order  = 1
 }
 
+resource "authentik_policy_binding" "family_portal_admin" {
+  target = authentik_application.family_portal.uuid
+  group  = authentik_group.infra_admins.id
+  order  = 0
+}
+
+resource "authentik_policy_binding" "family_portal_family" {
+  target = authentik_application.family_portal.uuid
+  group  = authentik_group.family.id
+  order  = 1
+}
+
 
 # 2. Shared & Member Applications (Accessible to all authenticated users)
 resource "authentik_policy_binding" "grafana_users" {