ai: add doc comment noting secrets are now provisioned via Woodpecker

No functional change -- this comment-only edit exists to trigger a real
deploy of the ai stack so provision-secrets' ai) case, and the AI_
var-name fix from PR #7, get exercised end-to-end for the first time.

Documents that MCPO_API_KEY is intentionally still manual/unmigrated.

ai/ai.yaml

@@ -1,3 +1,8 @@
+# NOTE: litellm's AWS/DB/master-key secrets, open-webui's secret key/DB URL,
+# and the OAuth client secret are provisioned into ai/ai.env at deploy time
+# from Woodpecker secrets (see PRs #4, #6, #7) -- not committed here.
+# MCPO_API_KEY (used by mcpo and mcpo-critical) is NOT yet migrated; it
+# remains manually managed in ai/ai.env by design (see PR #4 discussion).
 services:
   open-webui:
     image: ghcr.io/open-webui/open-webui:0.11.1