fix(ssl+agent): capath for all HTTP clients + isolate gradio import

SSL fix (ADR-0009 Finding 7):
- Replace ssl.create_default_context() with system_ssl_context(capath)
  in client_registry.py, async_network.py, notifications/providers.py,
  git/_base.py. Previous fix (0.5.1) only covered LLM clients; the
  Superset API client still used ssl.create_default_context() which
  loads cafile (flat bundle) where OpenSSL 3.x ignores intermediate CA
  certificates. system_ssl_context() uses capath only (hash symlinks).

Agent fix:
- Extract _check_llm_provider_health + _llm_status from agent/app.py
  into agent/_llm_health.py. The /api/agent/llm-status endpoint was
  importing from agent/app.py which triggers 'import gradio' at module
  level. Backend container does not have gradio installed, causing
  ModuleNotFoundError (500 error) every 30s on health check polling.

Config:
- Add ALLOWED_ORIGINS to docker-compose.yml + docker-compose.enterprise-clean.yml

ADR-0009 updated: Layer 2 table expanded with 4 missing clients,
Finding 5 reconciled (LLM_CA_CERT_URLS restored in 0.5.1), version 0.5.2.

Verified: 1110 unit tests passed, gradio import isolation confirmed.

backend/src/agent/_llm_health.py

@@ -0,0 +1,96 @@
+# backend/src/agent/_llm_health.py
+# #region AgentChat.LlmHealth [C:3] [TYPE Module] [SEMANTICS agent-chat,llm,health,status]
+# @ingroup AgentChat
+# @BRIEF LLM provider health check with in-memory cache (30s TTL).
+#   Extracted from agent/app.py to avoid importing gradio in backend container.
+# @LAYER Infrastructure
+# @RELATION CALLED_BY -> [api/routes/agent_status.py]
+# @RELATION CALLED_BY -> [agent/app.py]
+# @RATIONALE agent/app.py imports gradio at module level (line 28). The backend
+#   container does not have gradio installed (only the agent container does).
+#   The /api/agent/llm-status endpoint needs _check_llm_provider_health but must
+#   not trigger gradio import. This module isolates the health-check logic.
+# @POST Returns status string: 'ok' | 'unavailable' | 'timeout' | 'auth_error'.
+# @SIDE_EFFECT Makes a probe request to the LLM provider; caches result in module memory.
+
+import time
+from typing import Any
+
+import httpx
+from langchain_core.messages import HumanMessage
+from langchain_openai import ChatOpenAI
+from openai import APIConnectionError, APITimeoutError, AuthenticationError, RateLimitError
+
+from src.agent._llm_params import chat_openai_kwargs
+from src.core.logger import logger
+
+# ── LLM provider health cache ─────────────────────────────────────────
+_llm_status: dict[str, Any] = {
+    "status": "ok",
+    "last_error": "",
+    "last_check_ts": 0.0,
+}
+_LLM_CHECK_CACHE_TTL = 30  # seconds between health checks
+_LLM_LAST_ERROR_KEY = "last_llm_error"
+_LLM_LAST_ERROR_TS_KEY = "last_llm_error_ts"
+
+
+# #region AgentChat.LlmHealth.Check [C:2] [TYPE Function] [SEMANTICS agent-chat,llm,health,check]
+# @ingroup AgentChat
+# @BRIEF Check LLM provider connectivity with in-memory cache (30s TTL).
+# @POST Returns status string: 'ok' | 'unavailable' | 'timeout' | 'auth_error'.
+# @SIDE_EFFECT Makes a probe request to the LLM provider; caches result in module memory.
+# @RATIONALE Prevents sending every user request into a dead LLM backend.
+async def _check_llm_provider_health() -> str:
+    """Check LLM provider connectivity. Cached for _LLM_CHECK_CACHE_TTL seconds."""
+    now = time.time()
+    if now - _llm_status["last_check_ts"] < _LLM_CHECK_CACHE_TTL:
+        return _llm_status["status"]
+
+    try:
+        from src.agent.langgraph_setup import _fetch_llm_config as _get_config
+
+        config = await _get_config()
+        if not config or not config.get("configured"):
+            return _llm_status["status"]
+
+        llm = ChatOpenAI(
+            **chat_openai_kwargs(
+                model=config.get("default_model", "gpt-4o-mini"),
+                base_url=config.get("base_url", "https://api.openai.com/v1"),
+                api_key=config.get("api_key", ""),
+                max_tokens=1,
+            )
+        )
+        await llm.ainvoke([HumanMessage(content="ping")])
+        _llm_status["status"] = "ok"
+        _llm_status["last_error"] = ""
+        _llm_status["last_check_ts"] = time.time()
+        return "ok"
+    except (APIConnectionError, httpx.ConnectError):
+        _llm_status["status"] = "unavailable"
+        _llm_status["last_error"] = "Connection refused"
+        _llm_status["last_check_ts"] = time.time()
+        return "unavailable"
+    except (APITimeoutError, httpx.ReadTimeout):
+        _llm_status["status"] = "timeout"
+        _llm_status["last_error"] = "Request timed out"
+        _llm_status["last_check_ts"] = time.time()
+        return "timeout"
+    except AuthenticationError:
+        _llm_status["status"] = "auth_error"
+        _llm_status["last_error"] = "Invalid API key"
+        _llm_status["last_check_ts"] = time.time()
+        return "auth_error"
+    except Exception as exc:
+        if "usage_metadata.total_tokens" in str(exc):
+            _llm_status["status"] = "ok"
+            _llm_status["last_error"] = ""
+            _llm_status["last_check_ts"] = time.time()
+            return "ok"
+        logger.explore("LLM health check failed", error=str(exc), extra={"src": "AgentChat.LlmHealth.Check"})
+        return _llm_status["status"]  # return cached status on unexpected errors
+
+
+# #endregion AgentChat.LlmHealth.Check
+# #endregion AgentChat.LlmHealth