Initial implementation of nebari-llm-serving-pack

Tracking issue for the initial implementation of the Nebari LLM serving pack.

See docs/design.md for the full design document.

Summary

This pack deploys a Go operator that watches LLMModel CRDs to manage LLM serving via llm-d. Each model gets:

• vLLM serving pods with init container for model download
• InferencePool + EPP for intelligent inference scheduling
• External endpoint with API key auth
• Internal endpoint with OIDC/JWT auth
• Token counting and rate limiting via Envoy AI Gateway

An optional key manager web UI lets users generate API keys for models they have access to, based on their OIDC groups.

Start with docs/design.md, the only file named in the issue, to understand the proposed pack architecture and implementation scope. Then identify the entry points for the Go operator, LLMModel CRDs, serving endpoints, authentication, and the optional key manager. Done means the initial pack provides the listed serving, scheduling, access-control, rate-limiting, and key-management capabilities.