Move ai-stack and paintplus vendored source under vendor/

Matches the existing vendor/easy-asterisk convention (used by
services/asterisk.sh) instead of two one-off top-level directories that
cluttered the repo root and didn't look like anything else next to
setup.sh, lib/, services/, extras/. Only the two services' own SRC_DIR
path resolution and header comments needed updating — nothing else in
the repo referenced the old ./ai-stack / ./paintplus paths.

Also documents vendor/ in README.md's Layout section.

README.md

@@ -176,6 +176,9 @@ backup
 setup.sh          dispatcher — wizard, direct install, --list, --dry-run
 lib/common.sh     shared helpers: logging, prompts, site config, OS detection
 services/         one file per service (self-registering)
+vendor/           full app source trees vendored for a service (e.g. ai-stack,
+                  paintplus, easy-asterisk) — copied into place at install time,
+                  no network clone needed
 extras/           non-Docker assets bundled with the repo (e.g. sync_cc.py)
 CLAUDE.md         contributor guide — how to add services, available helpers
 ```