nvim: local FIM autocomplete via minuet-ai, replacing the copilot that was off

copilot has been commented out on every machine with "deliberately off". This
is what replaces it: minuet-ai in virtual-text mode against qwen3-coder-30b on
mainframe's 3060. Nothing leaves the LAN -- llm.rcjohnstone.com has no public
A record, uses the internal CA, and Caddy source-IP gates it.

⚠ Route is /v1/completions, NOT /infill. Measured through the proxy:
/v1/completions returns 200 with FIM tokens in a raw prompt, /infill is 404
because LiteLLM does not expose it. llama.vim wants /infill, which would mean
talking to llama-server directly and bypassing the virtual key -- and on the
work laptop that key IS the policy boundary making Anthropic and PRC models
403. Not worth routing around for an editor plugin.

⚠ max_tokens is 32 on purpose. Measured on the real path at 48: `def add` came
back with `sub` and `mul` attached, so most of the latency was spent generating
text that would be discarded. Stop tokens include a blank line for the same
reason.

⚠ Expect occasional multi-second pauses: llama-swap is -np 1 with a ttl, so a
completion after another model was used pays a full reload. ~10 s cold,
0.7-1.3 s warm, measured end to end through the work key. Accepted because
concurrent agentic work is not viable on this hardware anyway.

Virtual text rather than a cmp source because there is no completion engine
installed here, and ghost text is the copilot-shaped one. Silent no-op when
LITELLM_KEY_NVIM is unset, so the headless NAS is unaffected.

common/zsh/secrets.zsh.example

@@ -10,3 +10,21 @@ export LASTFM_API_SECRET=""
 # Read by the opencode profiles as {env:LITELLM_KEY}. opencode has no fallback
 # syntax, so an unset value becomes an empty string and every request 401s.
 export LITELLM_KEY=""
+
+# ------------------------------------------------------------------------------
+# nvim FIM autocomplete (minuet-ai -> LiteLLM -> qwen3-coder-30b)
+# ------------------------------------------------------------------------------
+# ⚠ WHICH KEY DEPENDS ON THE MACHINE, and on the work laptop it is the policy
+# boundary, not a preference. `litellm-key-work` is enforced server-side to 403
+# Anthropic and PRC-origin models; a personal key here would silently remove
+# that guarantee for anything nvim sends.
+#
+#   sctfw004 (work)          rbw get litellm-key-work
+#   mainframe / system76     rbw get litellm-key-personal
+#
+# The NAS does not need it -- nvim disables the plugin silently when unset.
+export LITELLM_KEY_NVIM="$(rbw get litellm-key-work 2>/dev/null)"
+
+# Where the proxy lives. Mainframe talks to itself; every other machine uses
+# the internal name, which has no public A record and is source-IP gated.
+# export LITELLM_BASE="https://llm.rcjohnstone.com"