Raphael v2.4

Bearer Token Middleware: auth_middleware added to Axum via axum::middleware::from_fn. Protected and public routers are now separated in main.rs.
Webhook Routes Stay Public: /webhook/messages and /webhook/messages/bulk are internal Docker network calls — intentionally excluded from auth requirements.
Bot Auth Interceptor: Global Axios interceptor added to discord-bot/src/index.ts — automatically injects Authorization: Bearer <API_KEY> on every Rust backend call. Resolved all 401 errors on backfill and slash commands.

Separate Docker Compose Stack: LocalAI lives in its own infrastructure/localai/docker-compose.yml with [cpu] and [gpu] profiles — optional and independent from the main stack.
Host Port 8088: Port 8080 was occupied on RS4000; LocalAI's host binding moved to 8088. The Rust backend still reaches it at http://localai:8080/v1 over the Docker network — unaffected.
External Network Join: LocalAI joins infrastructure_secondbrain-network as an external network so all services can communicate without configuration changes.

Historical Backfill: backfill.ts fetches up to 2,000 messages per tracked channel from Discord history on bot startup and bulk-inserts via /webhook/messages/bulk. ON CONFLICT DO NOTHING makes it safe to run on every restart.

AliExpress Stubs: /api/shop/aliexpress (product parse) and /api/shop/track (package tracking) added as protected endpoints — ready for full implementation in a future phase.
Plugin Architecture: /api/plugins lists available plugins. Dynamic loading is stubbed and ready for Phase 7.
Git Safety: .gguf, .bin, .onnx, and *.gguf.partial model binary files added to .gitignore and removed from git history.

System is fully operational and in active testing. All six phases complete.