Move ai-stack and paintplus vendored source under vendor/

Matches the existing vendor/easy-asterisk convention (used by
services/asterisk.sh) instead of two one-off top-level directories that
cluttered the repo root and didn't look like anything else next to
setup.sh, lib/, services/, extras/. Only the two services' own SRC_DIR
path resolution and header comments needed updating — nothing else in
the repo referenced the old ./ai-stack / ./paintplus paths.

Also documents vendor/ in README.md's Layout section.

vendor/paintplus/frontend/Dockerfile

@@ -0,0 +1,31 @@
+FROM node:20-alpine as build
+
+WORKDIR /app
+
+# Copy package files
+COPY package.json package-lock.json ./
+
+# Install dependencies
+RUN npm ci
+
+# Copy source
+COPY . .
+
+# Build webpack bundle
+RUN npm run build
+
+# Production stage
+FROM nginx:alpine
+
+# Copy all static files needed by miniPaint
+COPY --from=build /app/index.html /usr/share/nginx/html/
+COPY --from=build /app/dist /usr/share/nginx/html/dist
+COPY --from=build /app/images /usr/share/nginx/html/images
+COPY --from=build /app/src/css /usr/share/nginx/html/src/css
+
+# Copy nginx config
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+
+CMD ["nginx", "-g", "daemon off;"]