Initial open-source release (MIT): image2api AI gateway

Full Go backend + Vue 3 frontend, OpenAI-compatible API, multi-provider
account pools, billing/admin, Docker one-command deploy with auto HTTPS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/docker-entrypoint.d/10-selfsigned.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Bootstrap a self-signed cert so nginx's 443 server block can start BEFORE
+# acme.sh has issued the real certificate. acme.sh later overwrites these files
+# in the shared volume; 30-cert-watch.sh reloads nginx when that happens.
+set -e
+D="${DOMAIN:-localhost}"
+CERT_DIR="/etc/nginx/certs/live/$D"
+mkdir -p "$CERT_DIR" /var/www/acme
+if [ ! -s "$CERT_DIR/fullchain.pem" ] || [ ! -s "$CERT_DIR/privkey.pem" ]; then
+  echo "nginx: generating self-signed bootstrap cert for $D"
+  openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+    -keyout "$CERT_DIR/privkey.pem" -out "$CERT_DIR/fullchain.pem" \
+    -subj "/CN=$D" >/dev/null 2>&1
+fi

frontend/docker-entrypoint.d/30-cert-watch.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Reload nginx whenever the certificate file changes — i.e. once acme.sh has
+# issued/renewed the real cert into the shared volume, nginx picks it up within
+# ~a minute without a container restart. Runs in the background so it doesn't
+# block startup.
+D="${DOMAIN:-localhost}"
+CERT="/etc/nginx/certs/live/$D/fullchain.pem"
+(
+  last=""
+  while true; do
+    sleep 60
+    cur="$(stat -c %Y "$CERT" 2>/dev/null || echo '')"
+    if [ -n "$cur" ] && [ "$cur" != "$last" ]; then
+      # Skip the very first observation (the self-signed bootstrap); only reload
+      # on a genuine change (acme.sh overwrote the cert).
+      [ -n "$last" ] && nginx -s reload 2>/dev/null || true
+      last="$cur"
+    fi
+  done
+) &