introduce separate weave-proxy service which holds the API key

This prevents opencode from having access to the `WEAVE_API_KEY` enviroment variable.

README.md

@@ -22,9 +22,10 @@ A first run from a clean checkout.
 
    ```yaml
    services:
-     opencode:
+     weave-proxy:
        environment:
          WEAVE_API_KEY: "your-key-here"
+     opencode:
        volumes:
          - /path/to/your/repo:/workspace/repo
    ```
@@ -121,8 +122,7 @@ name** from that stack's compose and `<port>` is the container's *internal* port
 - **`model` / `small_model`** — default model and the model used for lighter
   tasks. Both default to `weave/glm-5.2`.
 - **`provider.weave`** — the weave provider, using the
-  `@ai-sdk/openai-compatible` adapter against `https://weave.redpencil.io/v1`
-  with the key from `WEAVE_API_KEY`.
+  `@ai-sdk/openai-compatible` adapter against `http://weave-proxy/v1`.
 - **`provider.weave.models`** — the models offered in `/models`.
 - **`lsp`** — language servers baked into the image:
   `typescript-language-server` for TS/JS and `pyright` for Python.