Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

README.md

@@ -27,6 +27,7 @@ DNS Names:
 	vault.ladkau.de
 	dl.ladkau.de
 	agent.ladkau.de
+	fuelish.ladkau.de
 
 Purpose:
 --
@@ -75,6 +76,7 @@ Repo layout:
 			browserless/     # headless Chromium (internal network only)
 			searxng/         # metasearch for the chat web_search tool (internal network only)
 			n8n/             # AI chat and scheduled digests (agent.ladkau.de)
+			fuelish/         # receipt OCR job API for the Android app (fuelish.ladkau.de)
 	docs/
 		runbook-provisioning.md  # step-by-step reinstall instructions
 		runbook-configuration.md # first-run service configuration