chat(devnet-6): enable panda-chat AI chat for glamsterdam-devnet-6

[qu0b]

Enables the per-devnet AI chat for glamsterdam-devnet-6 at
chat.glamsterdam-devnet-6.ethpandaops.io, mirroring the bal-devnet-7 pilot:
the two-container pod (Open-WebUI → Hermes → panda-server), image
…-12400d1, panda-chat chart 0.3.0.

Changes

• Inventory ansible/inventories/devnet-6/group_vars/all/chat.yaml (source of
  truth): chat + panda enabled, pinned image, OpenRouter LLM.
• Rendered kubernetes/devnet-6/chat/: Chart.yaml dep → 0.3.0, Chart.lock,
  values.yaml (network glamsterdam-devnet-6, chainId 7052886157, glamsterdam
  devnetTools URLs, concise system prompt), vendored panda-chat-0.3.0.tgz.

Validation

• helm template chat . renders clean — prompt, image, all DEVNET_* URLs,
  langfuse env, and ingress host all resolve to glamsterdam-devnet-6.
• Data is live (verified via local panda CLI):
  • active in cartographoor (devnet_group: glamsterdam);
  • present in the ethnode datasource (direct EL/CL access);
  • container logs in external.otel_logs — 11.2M rows / last 6h across 11 services.

Secrets / edge auth (no per-devnet work)

• Reuses the central services.enc.yaml#chat (llm_api_key, langfuse keys,
  panda_bot_username/token) and the wildcard chat.*.ethpandaops.io Cloudflare
  Access app — same as bal-devnet-7 and the (now-rotated-out) devnet-5 pilot.

Notes / caveats

• The rendered chat/ dir is hand-mirrored from the working bal-devnet-7
  output, not produced by re-running generate_kubernetes_config. The vendored
  chat.yaml.j2 on the qu0b/faucet-agents collection branch is still the early
  shape (targets panda-chat 0.1.1, no panda-chat: wrapper, old
  credentialsJson/credentialsFile auth, Anthropic-direct default model) — running
  the role against it would regress this dir to a broken config. Aligning that
  template to the 0.3.0 shape is the standing follow-up before chat goes
  re-render-safe.
• Post-merge: ArgoCD sync → ~10 min cold start → e2e check in OW.