Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

ansible/group_vars/all/vars.yml

@@ -93,6 +93,13 @@ roundcube_smtp_port: "587"
 act_runner_version: "latest"
 act_runner_data_dir: /opt/act_runner
 act_runner_count: 3
+# Swap file created by the base role (the VPS has no swap partition)
+base_swap_size: "4G"
+base_swappiness: 10   # use swap only under real memory pressure
+
+# Memory cap per CI job container (swap disabled inside the job): a build that needs more is killed
+# instead of exhausting the host
+act_runner_job_memory: "4g"
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # gitea_runner_registration_token: ""  # Gitea admin → Site Administration → Runners → Create runner token
 
@@ -133,17 +140,23 @@ ollama_context_length: 16384
 ollama_mem_limit: 4608m
 ollama_keep_alive: "1h"   # unload the model after this idle time to free RAM
 
-# Browserless — headless Chromium for rendering JavaScript-heavy pages (internal only)
-browserless_version: "v2.57.0"
-browserless_data_dir: /opt/browserless
-browserless_mem_limit: 1g
-
-# SearXNG — metasearch backend for the n8n web_search tool (internal only)
-searxng_version: "2026.10.2-19ffbcd30"
-searxng_data_dir: /opt/searxng
-searxng_mem_limit: 384m
+# Fuelish — receipt OCR job API for the Android app (fuelish.ladkau.de)
+# The image is pushed to the private registry with upload-image.sh in the fuelish project;
+# after pushing a new version, set fuelish_version and deploy with --tags fuelish.
+domain_fuelish: "fuelish.{{ domain_base }}"
+fuelish_image: "{{ domain_registry }}/fuelish/tools"
+fuelish_version: "0.1.1"   # needs X-API-Key support (fuelish commit 7a91a37 or later) and OLLAMA_NUM_CTX / OLLAMA_NUM_THREAD (version 0.1.1 or later)
+fuelish_data_dir: /opt/fuelish
+fuelish_model: "{{ ollama_model }}"   # same model as n8n, so the shared Ollama keeps a single model loaded
+fuelish_mem_limit: 768m
+# Request options of the API; they equal the numCtx / numThread of the n8n Ollama nodes (16384 / 4)
+fuelish_num_ctx: "{{ ollama_context_length }}"
+fuelish_num_thread: 4
+# Registry account used to pull the image: the first registry_users entry unless overridden in the vault
+fuelish_registry_user: "{{ registry_users[0].username }}"
+fuelish_registry_password: "{{ registry_users[0].password }}"
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
-# searxng_secret_key: ""   # generate: openssl rand -hex 32
+# fuelish_api_key: ""   # generate: openssl rand -hex 32 — the same value goes into the Android app settings
 
 # n8n — workflow automation, AI chat and scheduled digests (agent.ladkau.de)
 domain_n8n: "agent.{{ domain_base }}"
@@ -170,6 +183,7 @@ smtp_port: 465
 smtp_secure: true   # true = implicit TLS (port 465); false = STARTTLS (port 587)
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # n8n_encryption_key: ""   # generate: openssl rand -hex 32
+# searxng_secret_key: ""   # generate: openssl rand -hex 32 (SearXNG, the internal search backend)
 # gemini_api_key: ""      # Google AI Studio API key (default model of the Telegram chat)
 # telegram_bot_token: ""   # from @BotFather
 # telegram_user_id: ""     # your numeric Telegram user id (the only user the bot answers)
@@ -178,3 +192,13 @@ smtp_secure: true   # true = implicit TLS (port 465); false = STARTTLS (port 587
 # n8n_users:
 #   - username: admin
 #     password: "your-password"
+
+# n8n backend: Browserless — headless Chromium for the fetch_page tool (internal only)
+browserless_version: "v2.57.0"
+browserless_data_dir: /opt/browserless
+browserless_mem_limit: 1g
+
+# n8n backend: SearXNG — metasearch for the web_search tool (internal only)
+searxng_version: "2026.10.2-19ffbcd30"
+searxng_data_dir: /opt/searxng
+searxng_mem_limit: 384m