feat(projekt-matching): langfuse project, keys, score configs; admin API in pod script

create_pod_langflow.sh

@@ -64,6 +64,12 @@ LANGFUSE_INIT_PUBLIC_KEY="pk-lf-00000000-0000-0000-0000-000000000001"
 LANGFUSE_INIT_SECRET_KEY="sk-lf-00000000-0000-0000-0000-000000000002"
 LANGFUSE_INIT_EMAIL="admin@example.com"
 LANGFUSE_INIT_PASSWORD="langfuse-admin-pw"
+# Admin key for the Organization Management API (used once by
+# projekt-matching/deploy/setup_langfuse.py to create the projekt-matching
+# project); PM_* keys are the Langfuse project keys Langflow traces to.
+LANGFUSE_ADMIN_API_KEY="admin-pm-3f61c2a89d4e"
+PM_LANGFUSE_PUBLIC_KEY="pk-lf-e12a9a7b-a87d-420c-b047-fd00885695eb"
+PM_LANGFUSE_SECRET_KEY="sk-lf-d0d55349-79fd-446d-b589-3ac4f35a0064"
 # Langflow sends its run traces to the in-pod Langfuse using the keys above.
 # NOTE: the Langfuse web (Next.js) server binds to the pod's hostname/IP, NOT
 # 127.0.0.1, so Langflow must address it via the pod name (which every pod
@@ -243,6 +249,16 @@ echo "Container '$REDIS_CTR_NAME' started (rc=$?)"
 # Podman automatically provides the `host.containers.internal` hostname in the
 # container's /etc/hosts (pointing at the host), so flows can reach the local
 # vLLM OpenAI-compatible endpoint on the host without an explicit --add-host.
+# PYTHONPATH=/app/langflow: durable equivalent of the projektmatch.pth file
+# deploy_files.sh writes into the venv's ephemeral site-packages. This unit is
+# generated with `podman generate systemd --new` (--rm + --replace in
+# ExecStart), so ANY restart of this container -- including the `podman
+# restart` deploy_files.sh issues after writing the .pth -- makes systemd
+# recreate it from the image, wiping the just-written .pth before the live
+# Langflow process (or any later exec) can ever observe it (verified: two
+# consecutive deploy_files.sh runs never converged). Setting PYTHONPATH here
+# survives every recreation because it's baked into the podman run command
+# itself, so "import projektmatch" works from the very first boot.
 podman run -d --name "$LANGFLOW_CTR_NAME" --pod "$POD_NAME" \
   -e LANGFLOW_DATABASE_URL="$LANGFLOW_DB_URL" \
   -e LANGFLOW_CONFIG_DIR=/app/langflow \
@@ -251,8 +267,9 @@ podman run -d --name "$LANGFLOW_CTR_NAME" --pod "$POD_NAME" \
   -e LANGFLOW_PRETTY_LOGS=true \
   -e LANGFLOW_LOG_LEVEL=INFO \
   -e DO_NOT_TRACK=True \
-  -e LANGFUSE_PUBLIC_KEY="$LANGFUSE_INIT_PUBLIC_KEY" \
-  -e LANGFUSE_SECRET_KEY="$LANGFUSE_INIT_SECRET_KEY" \
+  -e PYTHONPATH=/app/langflow \
+  -e LANGFUSE_PUBLIC_KEY="$PM_LANGFUSE_PUBLIC_KEY" \
+  -e LANGFUSE_SECRET_KEY="$PM_LANGFUSE_SECRET_KEY" \
   -e LANGFUSE_HOST="$LANGFUSE_INPOD_HOST" \
   -v "$LANGFLOW_DATA_DIR:/app/langflow:Z" \
   "$LANGFLOW_IMAGE"
@@ -267,6 +284,7 @@ echo "Container '$LANGFUSE_WORKER_CTR_NAME' started (rc=$?)"
 # Langfuse web container (exposed on host port 8091 -> 3000)
 podman run -d --name "$LANGFUSE_WEB_CTR_NAME" --pod "$POD_NAME" \
   "${LANGFUSE_COMMON_ENV[@]}" \
+  -e ADMIN_API_KEY="$LANGFUSE_ADMIN_API_KEY" \
   -e NEXTAUTH_SECRET="qwexczutbewrgerznupvemqyw" \
   -e LANGFUSE_INIT_ORG_ID="$LANGFUSE_INIT_ORG" \
   -e LANGFUSE_INIT_ORG_NAME="Test Org" \