revert: restore registry cache, investigate LE cert

infra/migrations/031_fix_agent_defaults.sql

@@ -1,3 +1,13 @@
--- NO-OP: Previously forced vllm model on agents. Model config is now managed
--- via the OLLAMA_MODEL / VLLM_MODEL env vars and the ai_agents table at runtime.
--- Do not override model_provider or model_name in migrations.
+-- Fix agent default model_provider and model_name to match production config.
+-- The original migration 026 seeded with 'ollama'/'qwen3.5:9b-fast' but production
+-- uses vLLM. This migration updates agents that still have the old defaults,
+-- preserving any user customizations (only updates if model_name matches the old default).
+
+UPDATE ai_agents
+   SET model_provider = 'vllm',
+       model_name = 'AxionML/Qwen3.5-9B-NVFP4',
+       max_tokens = 2048,
+       updated_at = NOW()
+ WHERE slug IN ('document-extractor', 'event-classifier', 'thesis-rewriter')
+   AND source = 'system'
+   AND model_name = 'qwen3.5:9b-fast';

infra/migrations/033_stop_hardcoding_agent_model.sql

@@ -1,3 +1,16 @@
--- NO-OP: Previously forced vllm model on agents. Model config is now managed
--- via the ai_agents table at runtime. Do not override model_provider or
--- model_name in migrations.
+-- Stop hardcoding agent model_name in migrations.
+--
+-- Migration 029 previously forced model_name='qwen3.5:9b-fast' on every
+-- deploy, overwriting per-environment model configuration.  That migration
+-- has been fixed to only sync system_prompt (not model_name).
+--
+-- This migration updates agents still on the old ollama provider/model
+-- to use vllm with the default VLLM model.  Agents already configured
+-- with a different model (e.g. via the API) are left untouched.
+
+UPDATE ai_agents
+SET model_provider = 'vllm',
+    model_name     = 'AxionML/Qwen3.5-9B-NVFP4',
+    updated_at     = NOW()
+WHERE model_name IN ('qwen3.5:9b-fast', 'qwen3.5:9b')
+  AND source = 'system';