Architect agent: Claude-powered thesis generation (backend scaffolding)

- backend/mcp/architect_agent.py: generate_options + revise on Claude (prompt-
  cached thesis context, claude-opus-4-8, Ten31 voice rules). Writes N variant
  drafts to a node's variant group; nothing canonical without human approval.
  Fails gracefully if the API key / SDK is absent.
- server.py endpoints: GET /api/architect/status, GET /api/thesis/{key}/tree,
  GET /api/thesis/nodes/{id}/variants, POST .../generate, POST .../feedback,
  POST /api/thesis/lines, POST /api/thesis/lines/{key}/nodes. architect_tools
  gains get_node_variants.
- Dockerfile installs `anthropic`; docker_entrypoint loads ANTHROPIC_API_KEY from
  /data/secrets/anthropic-api-key (self-disabling until the key is dropped in).

Full HTTP surface verified end-to-end (graceful 502 without a key).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

start9/0.4/Dockerfile

@@ -49,7 +49,8 @@ RUN apt-get update \
 RUN pip install --no-cache-dir \
       cryptography==42.0.5 \
       fastembed==0.4.2 \
-      mcp==1.2.0
+      mcp==1.2.0 \
+      anthropic
 
 # ── Application source ──────────────────────────────────────────
 # Whole backend tree: server.py + all top-level modules (core_migrations,

start9/0.4/docker_entrypoint.sh

@@ -57,6 +57,18 @@ else
   echo "[entrypoint] Gmail integration: DISABLED (no key at $GMAIL_SA_KEY)"
 fi
 
+# ── Architect (Claude) API key ──────────────────────────────────
+# The Architect agent (thesis generation) runs on Claude. Drop your Anthropic
+# API key in this file to enable it; it stays on the box. Self-disabling until
+# the key is present (generation endpoints return a clear "not configured" error).
+ANTHROPIC_KEY_FILE="$SECRETS_DIR/anthropic-api-key"
+if [ -z "${ANTHROPIC_API_KEY:-}" ] && [ -f "$ANTHROPIC_KEY_FILE" ]; then
+  export ANTHROPIC_API_KEY="$(tr -d '\n\r' < "$ANTHROPIC_KEY_FILE")"
+  echo "[entrypoint] Architect: ANTHROPIC_API_KEY loaded from $ANTHROPIC_KEY_FILE"
+elif [ -z "${ANTHROPIC_API_KEY:-}" ]; then
+  echo "[entrypoint] Architect: no API key yet (drop it at $ANTHROPIC_KEY_FILE to enable thesis generation)"
+fi
+
 # ── Phase-0 ingest / retrieval env ──────────────────────────────
 # These are consumed by the ingest pipeline (backend/ingest/) and the MCP
 # server (backend/mcp/) — NOT by the CRM web server, which ignores them.