Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

ansible/roles/base/tasks/main.yml

@@ -152,3 +152,53 @@
     state: started
     enabled: true
   tags: base
+
+# Swap file: without swap, memory pressure ends in a frozen host instead of a slow one
+- name: Create swap file
+  ansible.builtin.command: fallocate -l {{ base_swap_size }} /swapfile
+  args:
+    creates: /swapfile
+  tags: base
+
+- name: Set swap file permissions
+  ansible.builtin.file:
+    path: /swapfile
+    owner: root
+    group: root
+    mode: "0600"
+  tags: base
+
+- name: Format swap file
+  ansible.builtin.shell: blkid -p /swapfile | grep -q 'TYPE="swap"' || mkswap /swapfile
+  register: base_mkswap
+  changed_when: "'Setting up swapspace' in base_mkswap.stdout"
+  tags: base
+
+- name: List active swap
+  ansible.builtin.command: swapon --noheadings --show=NAME
+  register: base_active_swap
+  changed_when: false
+  tags: base
+
+- name: Enable swap file
+  ansible.builtin.command: swapon /swapfile
+  when: "'/swapfile' not in base_active_swap.stdout"
+  tags: base
+
+- name: Mount swap file at boot
+  ansible.posix.mount:
+    src: /swapfile
+    path: none
+    fstype: swap
+    opts: sw
+    state: present
+  tags: base
+
+- name: Set swappiness
+  ansible.posix.sysctl:
+    name: vm.swappiness
+    value: "{{ base_swappiness }}"
+    sysctl_file: /etc/sysctl.d/60-swap.conf
+    state: present
+    reload: true
+  tags: base