Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

docs/runbook-configuration.md

@@ -550,9 +550,9 @@ A summary of a long page takes several minutes on the CPU-only model.
 
 ### 9.5 Ollama — local LLM server
 
-The `ollama` role runs Ollama (CPU only). It is reachable only on the internal
-Docker network `ollama_internal` at `http://ollama:11434`; there is no public
-route.
+The `ollama` role runs Ollama (CPU only). It is shared by n8n and fuelish and
+reachable only on the internal Docker network `ollama_internal` at
+`http://ollama:11434`; there is no public route.
 
 Settings in `ansible/group_vars/all/vars.yml`:
 
@@ -736,3 +736,48 @@ curl -s "https://api.telegram.org/bot<TOKEN>/getWebhookInfo"
 ```
 
 `getWebhookInfo` shows the registered URL and the last delivery error.
+
+## 10. Fuelish — receipt OCR API
+
+`https://fuelish.ladkau.de` serves the job API of the fuelish Android app
+(`POST /jobs`, `GET /jobs/{id}`, `GET /health`). Every `/jobs` request needs
+the header `X-API-Key: <fuelish_api_key>`.
+
+### 10.1 Publish an image version
+
+In the fuelish project (`registry.env` with the registry credentials):
+
+```bash
+echo 0.1.1 > tooling-container/VERSION    # new version number
+./build-image.sh && ./upload-image.sh      # pushes cr.ladkau.de/fuelish/tools:<version> and :latest
+```
+
+Set `fuelish_version` in `ansible/group_vars/all/vars.yml` to the same number
+and deploy:
+
+```bash
+ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags fuelish --ask-vault-pass
+```
+
+The image must be built from fuelish commit `7a91a37` or later; older images do
+not check the API key.
+
+### 10.2 Check the deployment
+
+```bash
+curl -s https://fuelish.ladkau.de/health                     # {"status":"ok"}
+curl -s -o /dev/null -w "%{http_code}\n" -X POST https://fuelish.ladkau.de/jobs   # without key: 401 or 403
+ssh -i keys/notroot_cloud_ladkau_de deploy@217.154.207.148 "sudo docker exec ollama ollama list"   # fuelish_model is present (the API pulls it if missing)
+```
+
+### 10.3 Android app
+
+In the app's Settings tab enter `https://fuelish.ladkau.de` as server URL and
+`fuelish_api_key` as API key.
+
+`fuelish_model` defaults to `ollama_model`, the model used by n8n, so both share
+one loaded model. The API sends the request options from `fuelish_num_ctx` and
+`fuelish_num_thread` (16384 and 4, the same as the n8n Ollama nodes), so
+alternating requests from both apps do not restart the Ollama runner. Keep these
+values equal to `ollama_context_length` and the `numThread` of the n8n Ollama
+nodes. Images before fuelish version 0.1.1 ignore the two settings.