Move ai-stack and paintplus vendored source under vendor/

Matches the existing vendor/easy-asterisk convention (used by
services/asterisk.sh) instead of two one-off top-level directories that
cluttered the repo root and didn't look like anything else next to
setup.sh, lib/, services/, extras/. Only the two services' own SRC_DIR
path resolution and header comments needed updating — nothing else in
the repo referenced the old ./ai-stack / ./paintplus paths.

Also documents vendor/ in README.md's Layout section.

vendor/paintplus/docker-compose.yml

@@ -0,0 +1,33 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: paintplus
+    ports:
+      - "3080:8000"
+    volumes:
+      - ./data:/app/data
+      - ./scripts:/scripts
+    environment:
+      - DATABASE_URL=sqlite:///./data/ai_photo_edit.db
+      - SECRET_KEY=${SECRET_KEY:-change-this-secret-key-in-production}
+      - AI_PROVIDER=${AI_PROVIDER:-mock}
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      - OPENAI_MODEL=${OPENAI_MODEL:-gpt-image-2}
+      - OPENAI_EDIT_MODEL=${OPENAI_EDIT_MODEL:-gpt-image-2}
+      - STABILITY_API_KEY=${STABILITY_API_KEY:-}
+      - REPLICATE_API_KEY=${REPLICATE_API_KEY:-}
+      - INVOKEAI_URL=${INVOKEAI_URL:-}
+      - INVOKEAI_DEFAULT_MODEL=${INVOKEAI_DEFAULT_MODEL:-flux-dev}
+      - COMFYUI_URL=${COMFYUI_URL:-}
+      - COMFYUI_DEFAULT_MODEL=${COMFYUI_DEFAULT_MODEL:-v1-5-pruned-emaonly.ckpt}
+      - CORS_ORIGINS=*
+    # DNS servers for reliable external API access (Replicate, etc.)
+    dns:
+      - 8.8.8.8
+      - 8.8.4.4
+    restart: unless-stopped
+
+volumes:
+  data: