Move ai-stack and paintplus vendored source under vendor/

Matches the existing vendor/easy-asterisk convention (used by
services/asterisk.sh) instead of two one-off top-level directories that
cluttered the repo root and didn't look like anything else next to
setup.sh, lib/, services/, extras/. Only the two services' own SRC_DIR
path resolution and header comments needed updating — nothing else in
the repo referenced the old ./ai-stack / ./paintplus paths.

Also documents vendor/ in README.md's Layout section.

vendor/paintplus/Makefile

@@ -0,0 +1,35 @@
+.PHONY: help up down build logs clean dev test
+
+help: ## Show this help message
+	@echo 'Usage: make [target]'
+	@echo ''
+	@echo 'Available targets:'
+	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "  %-15s %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+
+up: ## Start the application (production)
+	docker-compose up -d
+
+down: ## Stop the application
+	docker-compose down
+
+build: ## Build all containers
+	docker-compose build
+
+logs: ## Show logs
+	docker-compose logs -f
+
+clean: ## Remove all containers, volumes, and data
+	docker-compose down -v
+	rm -rf data/
+
+dev: ## Start the application (development mode)
+	docker-compose -f docker-compose.dev.yml up
+
+test: ## Run tests
+	@echo "Tests not yet implemented"
+
+restart: ## Restart the application
+	docker-compose restart
+
+ps: ## Show running containers
+	docker-compose ps