Move ai-stack and paintplus vendored source under vendor/

Matches the existing vendor/easy-asterisk convention (used by
services/asterisk.sh) instead of two one-off top-level directories that
cluttered the repo root and didn't look like anything else next to
setup.sh, lib/, services/, extras/. Only the two services' own SRC_DIR
path resolution and header comments needed updating — nothing else in
the repo referenced the old ./ai-stack / ./paintplus paths.

Also documents vendor/ in README.md's Layout section.

vendor/ai-stack/.gitignore

@@ -0,0 +1,23 @@
+# Generated by setup scripts — not tracked
+docker-compose.yml
+.env
+requirements.txt
+mcp_requirements.txt
+start.sh
+stop.sh
+status.sh
+pull-models.sh
+Caddyfile.example
+.ufw-done
+
+# Data directories
+workspace/
+repos/
+papers/
+index/
+logs/
+kiwix/
+gitea/
+portainer-data/
+invokeai-data/
+invokeai-outputs/