Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

ansible/roles/fuelish/templates/docker-compose.yml.j2

@@ -0,0 +1,33 @@
+# Managed by Ansible — do not edit manually
+services:
+  fuelish:
+    image: {{ fuelish_image }}:{{ fuelish_version }}
+    container_name: fuelish
+    restart: unless-stopped
+    command: ["uvicorn", "server:app", "--app-dir", "/opt/app/src", "--host", "0.0.0.0", "--port", "8000"]
+    environment:
+      OLLAMA_URL: "http://ollama:11434/api/chat"
+      OLLAMA_BASE_URL: "http://ollama:11434"
+      OLLAMA_MODEL: "{{ fuelish_model }}"
+      # Same request options as the n8n Ollama nodes, so the shared Ollama keeps its runner loaded
+      OLLAMA_NUM_CTX: "{{ fuelish_num_ctx }}"
+      OLLAMA_NUM_THREAD: "{{ fuelish_num_thread }}"
+      FUELISH_API_KEY: "{{ fuelish_api_key }}"
+    mem_limit: {{ fuelish_mem_limit }}
+    networks:
+      - traefik_public
+      - ollama_internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.fuelish.rule=Host(`{{ domain_fuelish }}`)"
+      - "traefik.http.routers.fuelish.entrypoints=websecure"
+      - "traefik.http.routers.fuelish.tls.certresolver=letsencrypt"
+      - "traefik.http.services.fuelish.loadbalancer.server.port=8000"
+      # The app polls GET /jobs/{id} while a receipt is processed
+      - "traefik.http.routers.fuelish.middlewares=rate-limit-lax@docker"
+
+networks:
+  traefik_public:
+    external: true
+  ollama_internal:
+    external: true