v0.6.5: dynamic config build, all providers/services opt-in via flags

- split litellm/config.yaml into per-provider fragments under litellm/config/
- build-config.py assembles config at startup based on .env (stdlib only, no deps)
  runs automatically via python:3.12-alpine container on make run/run-bg
- all providers/services now opt-in via flags (GROQ=1, CEREBRAS=1, CLAUDEBOX=1, etc.)
  API keys are stored in .env but nothing activates unless the flag is set
- MCP servers (browser, hybrids3, claudebox, claudebox-zai) also controlled by flags
- add Docker profiles for hybrids3, browser, ollama, speaches — all opt-in via flags
- claudebox/claudebox-zai profiles now driven by CLAUDEBOX/CLAUDEBOX_ZAI=1 flags
- hybrids3 removed from nginx depends_on (502s cleanly when disabled)
- litellm/config.yaml is generated at runtime — removed from git tracking
- rename ZAI_AUTH_TOKEN → CLAUDEBOX_ZAI_AUTH_TOKEN
- fix postgres data loss: mount .data/postgres directly to PGDATA (/var/lib/postgresql/data)
  previously mounted to parent dir — postgres fell back to ephemeral anonymous volume