Move static service docs into services/<name>.md companion files

Applies the new write_readme companion-doc convention to ai-stack,
paintplus, and kyber-launcher: install-time-invariant content (usage
walkthroughs, service tables, troubleshooting) moves out of the .sh
heredocs into sibling services/<name>.md files, leaving only genuinely
install-specific content inline.

- services/paintplus.md: config/cloud/GPU/ai-stack-backend/update/Caddy
  sections, picked up automatically via write_readme's companion-doc
  support.
- services/ai-stack.md: roles, GPU switcher, service URLs, cloud LLM
  provider setup, update, Caddy. ai-stack.sh can't use write_readme
  directly (its POST-INSTALL-NOTES.md filename deliberately avoids
  colliding with the vendored app's own README.md in the same
  directory), so it appends the companion file manually.
- services/kyber-launcher.md: the full SWBF2 (2017) + Kyber walkthrough,
  moved out of the root README's "Gaming scripts" section (which now
  just points here). kyber-launcher.sh now calls write_readme to deploy
  it to ~/.local/share/kyber/README.md, fixing a stale in-script pointer
  to a README section that no longer exists.

services/paintplus.sh

@@ -209,71 +209,22 @@ OVR
     configure_caddy_for_service "PaintPlus" "paintplus:8000" "paintplus" "$EXTRA_BLOCK"
 
     # ── README (deploy notes; the app's own docs are at src/README.md) ────────
-    write_readme "$PP_DIR" << MD
+    # Static usage sections (config, cloud/GPU/ai-stack modes, update, Caddy)
+    # live in the companion services/paintplus.md and get appended
+    # automatically by write_readme (lib/common.sh) — kept out of this
+    # heredoc since none of it depends on anything chosen during install.
+    write_readme "$PP_DIR" << 'MD'
 # PaintPlus (deployment)
 
 Self-hosted AI photo editor: paint a mask over any object, describe what you
 want, and the AI replaces just that region. The application source is vendored
-in ubuntu-post-install and copied here to \`src/\` (no network clone).
-App docs: \`src/README.md\`. Based on EditmaskwithAI.
+in ubuntu-post-install and copied here to `src/` (no network clone).
+App docs: `src/README.md`. Based on EditmaskwithAI.
 
 - URL: http://localhost:3080
 - No built-in login — protect via Authelia SSO if exposed.
-- Provider: set \`AI_PROVIDER\` in \`src/.env\` (openai, replicate, local_gpu, stability, comfyui, invokeai).
-- \`comfyui\`/\`invokeai\` can point at this box's own \`ai-stack\` service — see below.
-
-## Configure providers / keys
-Edit \`src/.env\` then restart (the compose file interpolates these — no env_file):
-\`\`\`bash
-cd $APP_DIR
-nano .env        # AI_PROVIDER, OPENAI_API_KEY / REPLICATE_API_KEY, HF_TOKEN
-docker compose up -d --build
-\`\`\`
-Keys: OpenAI https://platform.openai.com/api-keys · Replicate https://replicate.com/account/api-tokens
-
-## Cloud mode (no GPU)
-\`\`\`bash
-cd $APP_DIR
-docker compose up -d --build      # starts on http://localhost:3080
-docker compose logs -f
-docker compose down
-\`\`\`
-
-## Local GPU mode (NVIDIA, ~13 GB of models)
-\`\`\`bash
-cd $APP_DIR
-./install-local-gpu.sh            # toolkit + DNS fix + model prefetch
-./bring-up-local-gpu.sh           # docker compose -f docker-compose.gpu.yml up -d --build
-\`\`\`
-GPU auto-selects models by VRAM (FLUX >=24 GB, SDXL 12-24 GB, SD 1.5 <2 GB).
-
-## ai-stack backend (no extra GPU download)
-If the \`ai-stack\` service is installed on this box, PaintPlus can use its
-InvokeAI/ComfyUI containers instead of the cloud or its own GPU installer —
-select it during install, or switch later:
-\`\`\`bash
-cd $APP_DIR
-nano .env        # AI_PROVIDER=invokeai (or comfyui), INVOKEAI_URL=http://invokeai:9090
-docker network connect ai-stack_default paintplus   # one-time, if not already joined
-docker compose up -d --build
-\`\`\`
-PaintPlus reaches those containers by Docker network name, not localhost —
-both must be on the same network (\`ai-stack_default\`, ai-stack's default).
-If a small GPU is shared with ai-stack's local chat, swap to images first:
-\`~/docker/ai-stack/gpu-mode.sh images\`.
-
-## Update the app
-Re-run the PaintPlus installer (copies the latest vendored source over \`src/\`,
-keeping your \`src/.env\`), then rebuild:
-\`\`\`bash
-cd $APP_DIR && docker compose up -d --build
-\`\`\`
-
-## Caddy
-Reverse-proxied as \`paintplus:8000\` on \`${SITE_CADDY_NET:-caddy_net}\`. Cloud mode
-joins that network via \`src/docker-compose.override.yml\`; GPU mode is attached
-with \`docker network connect\` after start. Same for the ai-stack backend —
-attached to \`ai-stack_default\` with \`docker network connect\` after start.
+- Provider: set `AI_PROVIDER` in `src/.env` (openai, replicate, local_gpu, stability, comfyui, invokeai).
+- `comfyui`/`invokeai` can point at this box's own `ai-stack` service — see below.
 MD
 
     echo ""