feat: Intelligence Layer Phase 1 — orchestrator service

Adds the Gemini API orchestrator (ReAct tool loop → Claude responder):

Orchestrator engine + router:
- orchestrator_engine.py: Gemini API tool loop, Claude CLI handoff
- routers/orchestrator.py: POST /orchestrate (async job queue), GET /orchestrate/{job_id}

Tools (cortex/tools/):
- web.py: DuckDuckGo web search (no key required)
- ae_knowledge.py: ae_journal_search + ae_journal_entry_create (AE V3 API)
- ae_tasks.py: ae_task_list (reads agents_sync Kanban filesystem)
- files.py: file_read (path-allowlisted to safe dirs)

Config + deps:
- config.py: orchestrator, DuckDuckGo, and AE API settings
- requirements.txt: google-genai, duckduckgo-search
- .env.default: reference config with all new keys documented

Docs:
- CLAUDE.md, README.md, documentation/ added to repo
- Port references updated 7331 → 8000 throughout
- Default model updated to gemini-2.5-flash

Tested: ae_task_list, ae_journal_search, web_search all working end-to-end.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/config.py

@@ -4,6 +4,24 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 
 class Settings(BaseSettings):
     anthropic_api_key: str | None = None  # not used — claude CLI handles auth
+
+    # Orchestrator (Gemini API — separate from Gemini CLI)
+    # Get a key at: https://aistudio.google.com/apikey (free tier is sufficient)
+    gemini_api_key: str | None = None
+    orchestrator_model: str = "gemini-2.5-flash"    # model used for tool loop
+    orchestrator_max_rounds: int = 10               # safety cap on tool iterations
+
+    # DuckDuckGo search (used by orchestrator web_search tool)
+    # Leave blank to use the free unauthenticated tier; set to your API key for higher limits
+    ddg_api_key: str | None = None
+    ddg_max_results: int = 5
+
+    # Aether Platform API (used by orchestrator ae_journal_* and ae_task_list tools)
+    ae_api_url: str = "https://dev-api.oneskyit.com"
+    ae_api_key: str = ""          # x-aether-api-key header
+    ae_account_id: str = ""       # x-account-id header
+    ae_api_timeout: int = 15      # per-request timeout in seconds
+
     inara_dir: Path = Path("../inara")
     sessions_dir: Path = Path("./data/sessions")
     default_model: str = "claude-sonnet-4-6"