Replace Clay with n8n, Ollama, SearXNG and browserless; add Telegram assistant

Remove the Clay role (Claude Code web UI) and its Anthropic API key.

New roles:
- ollama: local CPU LLM (qwen3:4b-instruct), internal network only
- browserless: headless Chromium for JavaScript-heavy pages
- searxng: metasearch backend for the chat web_search tool
- n8n at agent.ladkau.de: web chat (/chat), scheduled workflows,
  Telegram bot; workflows and credentials are imported from the repo

Telegram bot: Gemini 3.8 -> Gemini 3.5 -> local Qwen fallback chain,
/qwen to force the local model, /stocks and a weekday schedule
(07:30, 13:00, 17:40) for the MTE.DE / PTX.F stock report.

Also: dashboard and check-services entries for the chat, vault checks
for the new secrets (n8n, SearXNG, Gemini, Telegram, SMTP), updated
CLAUDE.md, runbooks and README.

docs/runbook-provisioning.md

@@ -122,12 +122,17 @@ registry_users:
   - username: alice
     password: "your-password"
 
-# Clay — Claude Code web interface at agent.ladkau.de
-# Generate API key at console.anthropic.com → API keys
-anthropic_api_key: ""
-clay_users:
+# n8n — AI chat and scheduled digests at agent.ladkau.de
+n8n_users:                          # basic auth in front of n8n
   - username: admin
     password: "your-password"
+n8n_encryption_key: ""              # generate: openssl rand -hex 32 — never change after first deploy
+searxng_secret_key: ""              # generate: openssl rand -hex 32
+smtp_user: ""                       # full Strato mailbox address
+smtp_password: ""
+gemini_api_key: ""                 # Google AI Studio API key, see runbook-configuration.md section 9.8
+telegram_bot_token: ""              # from @BotFather, see runbook-configuration.md section 9.8
+telegram_user_id: ""                # your numeric Telegram user id
 
 # Gitea Actions runners — token obtained after Gitea is running
 # See step 3.4 of runbook-configuration.md; replace after Gitea admin account is created
@@ -229,8 +234,11 @@ This runs all roles in order:
 | 10 | `k8s`         | Placeholder page at k8s.ladkau.de |
 | 11 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
 | 12 | `dl`          | Public download server at dl.ladkau.de — nginx HTTPS + SFTP upload |
-| 13 | `clay`        | Claude Code web interface at agent.ladkau.de — basic auth, Anthropic API key required |
-| 14 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
+| 13 | `ollama`      | Local LLM server (Ollama, CPU) on the internal `ollama_internal` network — pulls `ollama_model` on first run |
+| 14 | `browserless` | Headless Chromium for rendering JavaScript-heavy pages — internal network only |
+| 15 | `searxng`     | Metasearch engine for the chat web_search tool — internal network only |
+| 16 | `n8n`         | n8n at agent.ladkau.de — AI chat (`/chat`), scheduled digests, basic auth; imports the workflows in the repo |
+| 17 | `dashboard`   | Public status dashboard at cloud.ladkau.de — service health and server stats |
 
 > **Note:** The `act_runner` role requires `gitea_runner_registration_token` in the
 > vault, which can only be obtained after Gitea is running and an admin account has