On the production stack a Grok bot only showed **"Main Bot couldn't
reply — something went wrong"** and the gateway logged nothing. Cause:
the bot's model endpoint (CLIProxyAPI on a tailnet address) was
unreachable from the gateway container on the Docker bridge — the same
request works from the host.

- `directModel`: a request that never reached the provider (DNS,
refused, timeout) now fails with "Model endpoint unreachable" (no URL in
the message).
- Bot runtime: failed turns log their kind (`bots: turn failed (…)`),
never URLs, keys or payloads.
- Web: that failure reads "couldn't reach the model provider".
- `docs/deploy.md`: the gateway container must reach model endpoints;
for tailnet-only endpoints run gateway and web on the host network bound
to loopback (override example + a curl check).

Checked: typecheck, bot platform integration tests. The production stack
now runs gateway/web with host networking and reaches the endpoint.