feat: OmniRoute corrigido + Pi Agent como subagente

- docker-compose: porta 4000, extra_hosts, traefik-net
- routes.yml: rota omniroute-https pra gateway.m5digital.net.br
- CLAUDE.md: seção Pi Agent com instruções de uso
- Pi Agent reconfigurado: Ollama Cloud → OmniRoute (NVIDIA NIM)
- 30 chaves NVIDIA rotacionando, duplicatas limpas
- Ollama: llama3 + qwen2.5:7b acessíveis via OmniRoute
- Wrapper pi-task criado em /usr/local/bin/pi-task

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -280,3 +280,33 @@ Tudo em `/root/inema_materiais/`:
 - `/root/.claude/CLAUDE.md` — Skills Hermes auto-invocadas
 - `/root/inema_materiais/` — Material INEMA (cursos, ads, vídeo)
 - `/root/backups/2026-07-06_pre-crm-reorg/MANIFEST.md` — Inventário pré-CRM
+---
+
+## Pi Agent — Subagente de Apoio
+
+**Binário:** `/usr/local/bin/pi` (v0.80.3)
+**Wrapper:** `/usr/local/bin/pi-task`
+**Config:** `/root/.pi/agent/`
+**Provider:** OmniRoute (localhost:4000) → NVIDIA NIM nemotron-3-super-120b-a12b
+
+### Quando usar o Pi:
+- Tarefas de verificação e consulta (status containers, disco, RAM)
+- Leitura e resumo de documentação
+- Execução de scripts simples
+- Consultas rápidas enquanto o Claude principal foca em tarefa complexa
+
+### Como invocar:
+```bash
+pi-task "verificar status dos containers"       # via NVIDIA (rápido)
+pi-task --local "listar arquivos"               # via Ollama (offline)
+pi-task --model llama-3.3-nemotron-super-49b-v1.5 "tarefa"
+```
+
+### Modelos disponíveis no Pi:
+| Modelo | Context | Velocidade | Uso |
+|--------|---------|------------|-----|
+| nemotron-3-super-120b-a12b | 131K | ~2s | Principal |
+| llama-3.3-nemotron-super-49b-v1.5 | 131K | ~2s | Alternativa |
+| ollama/qwen2.5:7b | 32K | ~30s | Offline |
+| ollama/llama3:latest | 8K | ~30s | Emergência |
+

scripts/traefik-conf/routes.yml

@@ -13,6 +13,8 @@ http:
       entryPoints:
         - websecure
       service: openwa
+      middlewares:
+        - openwa-headers
       tls:
         certResolver: letsencrypt
 
@@ -48,6 +50,55 @@ http:
       tls:
         certResolver: letsencrypt
 
+
+    painel-https:
+      rule: "Host(`painel.m5digital.net.br`)"
+      entryPoints:
+        - websecure
+      service: painel
+      tls:
+        certResolver: letsencrypt
+
+    painel-http:
+      rule: "Host(`painel.m5digital.net.br`)"
+      entryPoints:
+        - web
+      service: painel
+      middlewares:
+        - redirect-to-https
+
+    crm-https:
+      rule: "Host(`crm.m5digital.net.br`)"
+      entryPoints:
+        - websecure
+      service: twenty-crm
+      tls:
+        certResolver: letsencrypt
+
+    crm-app-https:
+      rule: "Host(`app.crm.m5digital.net.br`)"
+      entryPoints:
+        - websecure
+      service: twenty-crm
+      tls:
+        certResolver: letsencrypt
+
+    crm-m5online-https:
+      rule: "Host(`m5online.crm.m5digital.net.br`)"
+      entryPoints:
+        - websecure
+      service: twenty-crm
+      tls:
+        certResolver: letsencrypt
+
+    crm-medalpha-https:
+      rule: "Host(`medalpha.crm.m5digital.net.br`)"
+      entryPoints:
+        - websecure
+      service: twenty-crm
+      tls:
+        certResolver: letsencrypt
+
     chatwoot-https:
       rule: "Host(`chat.m5digital.net.br`)"
       entryPoints:
@@ -56,19 +107,11 @@ http:
       tls:
         certResolver: letsencrypt
 
-    crm5-https:
-      rule: "Host(`crm5.m5digital.net.br`)"
+    omniroute-https:
+      rule: "Host(`gateway.m5digital.net.br`)"
       entryPoints:
         - websecure
-      service: twenty-crm
-      tls:
-        certResolver: letsencrypt
-
-    crm-https:
-      rule: "Host(`crm.m5digital.net.br`)"
-      entryPoints:
-        - websecure
-      service: twenty-crm
+      service: omniroute
       tls:
         certResolver: letsencrypt
 
@@ -104,14 +147,6 @@ http:
       middlewares:
         - saleor-strip
 
-    saleor-graphql-http:
-      rule: "PathPrefix(`/graphql`)"
-      entryPoints:
-        - web
-      service: saleor-graphql
-      middlewares:
-        - saleor-graphql-strip
-
     saleor-dashboard-http:
       rule: "PathPrefix(`/dashboard`)"
       entryPoints:
@@ -137,6 +172,12 @@ http:
       stripPrefix:
         prefixes:
           - /wa
+    openwa-headers:
+      headers:
+        customRequestHeaders:
+          X-Forwarded-Proto: "https"
+        customResponseHeaders:
+          X-Frame-Options: "SAMEORIGIN"
     gitea-strip:
       stripPrefix:
         prefixes:
@@ -149,17 +190,12 @@ http:
       stripPrefix:
         prefixes:
           - /dashboard
-    crm-api-strip:
-      stripPrefix:
-        prefixes:
-          - /api
-    saleor-graphql-strip:
-      stripPrefix:
-        prefixes:
-          - /graphql
     chatwoot-redirect:
       redirectScheme:
         scheme: https
+    redirect-to-https:
+      redirectScheme:
+        scheme: https
 
   services:
     n8n:
@@ -174,10 +210,6 @@ http:
       loadBalancer:
         servers:
           - url: "http://m5_saleor:8000"
-    saleor-graphql:
-      loadBalancer:
-        servers:
-          - url: "http://m5_saleor:8000/"
     saleor-dashboard:
       loadBalancer:
         servers:
@@ -189,15 +221,24 @@ http:
     video:
       loadBalancer:
         servers:
-          - url: "http://yt-pub-livesx-dashboard-1:8091"
-    chatwoot:
-      loadBalancer:
-        servers:
-          - url: "http://chatwoot-chatwoot-1:3000"
+          - url: "http://172.18.0.11:8091"
     twenty-crm:
       loadBalancer:
         servers:
           - url: "http://twenty_front:3000"
+    chatwoot:
+      loadBalancer:
+        servers:
+          - url: "http://chatwoot:3000"
+
+    painel:
+      loadBalancer:
+        servers:
+          - url: "http://172.18.0.1:5173"
+    omniroute:
+      loadBalancer:
+        servers:
+          - url: "http://omniroute:20128"
     acme-webroot:
       loadBalancer:
         servers: