Add LLM client interface with LiteLLM adapter (A5/A11)

PR 2 of the steps-3/4 plan.

- llm.py: LLMClient protocol — complete(events, tools, model) ->
  canonical events — present from the first real LLM call.
  LiteLLMClient renders requests via the A10 renderer, targets the
  proxy's OpenAI-compatible route, and maps provider tool-call IDs
  to locally-minted canonical IDs at the boundary
- RoleMap (A11): executor/planner/delegate/consultant resolved from
  env; pinned() returns the mapping to record at task start
- Config strictly from env: NISSE_LLM_BASE_URL, NISSE_LLM_TOKEN;
  envfile.py is a minimal .env loader where real env wins; .env now
  gitignored with a committed .env.example documenting all variables
  (Matrix ones included for the upcoming transport PR)
- Live smoke test against the proxy is integration-marked and skips
  without credentials — CI stays credential-free per operator
  decision; the test runs locally once .env exists
- httpx added as nisse-dev's HTTP client

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,19 @@
+# Copy to .env (chmod 600). Real environment variables win over this file.
+# .env is gitignored; never commit real values.
+
+# --- LLM access (A5): the LiteLLM proxy is the single LLM destination ---
+NISSE_LLM_BASE_URL=http://litellm.example:4000
+NISSE_LLM_TOKEN=sk-your-litellm-virtual-key
+
+# --- Role mapping (A11): roles resolve to concrete model strings ---
+NISSE_ROLE_EXECUTOR=anthropic/claude-haiku-4-5-20251001
+NISSE_ROLE_PLANNER=anthropic/claude-opus-5
+NISSE_ROLE_DELEGATE=anthropic/claude-opus-5
+NISSE_ROLE_CONSULTANT=anthropic/claude-opus-5
+
+# --- Matrix transport (A1), used by nisse-dev's MatrixTransport ---
+NISSE_MATRIX_HOMESERVER=https://matrix.example
+NISSE_MATRIX_USER_ID=@nisse-dev:example
+NISSE_MATRIX_TOKEN=syt_your_matrix_access_token
+NISSE_MATRIX_ROOM_ID=!roomid:example
+NISSE_MATRIX_OPERATORS=@you:example