Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

ansible/roles/fuelish/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart fuelish
+  community.docker.docker_compose_v2:
+    project_src: "{{ fuelish_data_dir }}"
+    state: present
+    recreate: always

ansible/roles/fuelish/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+- name: Create fuelish directory
+  ansible.builtin.file:
+    path: "{{ fuelish_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: fuelish
+
+# The tools image is pushed to the private registry with upload-image.sh
+- name: Log in to the container registry
+  community.docker.docker_login:
+    registry_url: "{{ domain_registry }}"
+    username: "{{ fuelish_registry_user }}"
+    password: "{{ fuelish_registry_password }}"
+  no_log: true
+  tags: fuelish
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ fuelish_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart fuelish
+  tags: fuelish
+
+- name: Start fuelish
+  community.docker.docker_compose_v2:
+    project_src: "{{ fuelish_data_dir }}"
+    state: present
+    pull: always
+  tags: fuelish

ansible/roles/fuelish/templates/docker-compose.yml.j2

@@ -0,0 +1,33 @@
+# Managed by Ansible — do not edit manually
+services:
+  fuelish:
+    image: {{ fuelish_image }}:{{ fuelish_version }}
+    container_name: fuelish
+    restart: unless-stopped
+    command: ["uvicorn", "server:app", "--app-dir", "/opt/app/src", "--host", "0.0.0.0", "--port", "8000"]
+    environment:
+      OLLAMA_URL: "http://ollama:11434/api/chat"
+      OLLAMA_BASE_URL: "http://ollama:11434"
+      OLLAMA_MODEL: "{{ fuelish_model }}"
+      # Same request options as the n8n Ollama nodes, so the shared Ollama keeps its runner loaded
+      OLLAMA_NUM_CTX: "{{ fuelish_num_ctx }}"
+      OLLAMA_NUM_THREAD: "{{ fuelish_num_thread }}"
+      FUELISH_API_KEY: "{{ fuelish_api_key }}"
+    mem_limit: {{ fuelish_mem_limit }}
+    networks:
+      - traefik_public
+      - ollama_internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.fuelish.rule=Host(`{{ domain_fuelish }}`)"
+      - "traefik.http.routers.fuelish.entrypoints=websecure"
+      - "traefik.http.routers.fuelish.tls.certresolver=letsencrypt"
+      - "traefik.http.services.fuelish.loadbalancer.server.port=8000"
+      # The app polls GET /jobs/{id} while a receipt is processed
+      - "traefik.http.routers.fuelish.middlewares=rate-limit-lax@docker"
+
+networks:
+  traefik_public:
+    external: true
+  ollama_internal:
+    external: true