Replace Clay with n8n, Ollama, SearXNG and browserless; add Telegram assistant

Remove the Clay role (Claude Code web UI) and its Anthropic API key.

New roles:
- ollama: local CPU LLM (qwen3:4b-instruct), internal network only
- browserless: headless Chromium for JavaScript-heavy pages
- searxng: metasearch backend for the chat web_search tool
- n8n at agent.ladkau.de: web chat (/chat), scheduled workflows,
  Telegram bot; workflows and credentials are imported from the repo

Telegram bot: Gemini 3.8 -> Gemini 3.5 -> local Qwen fallback chain,
/qwen to force the local model, /stocks and a weekday schedule
(07:30, 13:00, 17:40) for the MTE.DE / PTX.F stock report.

Also: dashboard and check-services entries for the chat, vault checks
for the new secrets (n8n, SearXNG, Gemini, Telegram, SMTP), updated
CLAUDE.md, runbooks and README.

ansible/group_vars/all/vars.yml

@@ -125,12 +125,56 @@ dl_sftp_port: 2223
 # Status dashboard (public — cloud.ladkau.de root)
 dashboard_data_dir: /opt/dashboard
 
-# Clay — Claude Code web interface (agent.ladkau.de)
-domain_clay: "agent.{{ domain_base }}"
-clay_data_dir: /opt/clay
-clay_users: []   # override in vault with [{username: ..., password: ...}]
+# Ollama — local LLM server, internal network only (no public route)
+ollama_version: "0.35.1"
+ollama_data_dir: /opt/ollama
+ollama_model: "qwen3:4b-instruct-2507-q4_K_M"   # non-thinking variant: the thinking model needs minutes per answer on this CPU
+ollama_context_length: 16384
+ollama_mem_limit: 4608m
+ollama_keep_alive: "1h"   # unload the model after this idle time to free RAM
+
+# Browserless — headless Chromium for rendering JavaScript-heavy pages (internal only)
+browserless_version: "v2.57.0"
+browserless_data_dir: /opt/browserless
+browserless_mem_limit: 1g
+
+# SearXNG — metasearch backend for the n8n web_search tool (internal only)
+searxng_version: "2026.10.2-19ffbcd30"
+searxng_data_dir: /opt/searxng
+searxng_mem_limit: 384m
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
-# anthropic_api_key: ""           # from console.anthropic.com → API keys
-# clay_users:
+# searxng_secret_key: ""   # generate: openssl rand -hex 32
+
+# n8n — workflow automation, AI chat and scheduled digests (agent.ladkau.de)
+domain_n8n: "agent.{{ domain_base }}"
+n8n_version: "2.41.6"
+n8n_data_dir: /opt/n8n
+n8n_timezone: "Europe/Berlin"
+n8n_mem_limit: 768m
+# Fixed webhook id of the chat workflow: the chat page is served at
+# https://agent.<domain>/webhook/<id>/chat and https://agent.<domain>/chat redirects there.
+# Must match "webhookId" in roles/n8n/files/workflows/chat.json.
+n8n_chat_webhook_id: "3f2b6c1e-8a4d-4e57-9b0a-6d1c2e7f5a10"
+# Fixed webhook id of the Telegram trigger; must match "webhookId" in roles/n8n/files/workflows/telegram-chat.json.
+n8n_telegram_webhook_id: "7c1d4e92-5b3a-4f08-a6e1-2d9b8c0f3a47"
+# Source addresses allowed to call the Telegram webhook (Telegram's webhook servers, see
+# core.telegram.org/bots/webhooks). Set to [] to disable the address filter.
+telegram_webhook_source_ranges:
+  - 149.154.160.0/20
+  - 91.108.4.0/22
+n8n_users: []   # override in vault with [{username: ..., password: ...}] — basic auth in front of n8n
+
+# Outgoing mail for n8n (Strato SMTP)
+smtp_host: "smtp.strato.de"
+smtp_port: 465
+smtp_secure: true   # true = implicit TLS (port 465); false = STARTTLS (port 587)
+# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
+# n8n_encryption_key: ""   # generate: openssl rand -hex 32
+# gemini_api_key: ""      # Google AI Studio API key (default model of the Telegram chat)
+# telegram_bot_token: ""   # from @BotFather
+# telegram_user_id: ""     # your numeric Telegram user id (the only user the bot answers)
+# smtp_user: ""            # full Strato mailbox address
+# smtp_password: ""
+# n8n_users:
 #   - username: admin
 #     password: "your-password"