panel: remove the Ollama card and its controller entry

The local 14B model is not usable from this machine (8.25 tok/s prompt
processing; pi sends a 9,510-token agent prompt against a 4,096 context, so it
was truncated to 2,050 and still needed ~4 min before the first token). Nothing
about the panel was worth keeping for it.

- portal/tools.py: drop the 'Ollama Local LLM' tile (no other references remain)
- services.toml: drop the ollama allowlist entry; 8 services remain
- service_controller.py + docs: keep the generic 'systemd-system' kind but drop
  the ollama-specific wording and mark it as currently unused

Verified on .13: /api/services no longer lists ollama, the deployed tools.py has
0 ollama matches, the other 8 cards still report correctly, portal is healthy.

deploy/service-controller/service_controller.py

@@ -117,9 +117,9 @@ def _do(kind: str, action: str, target: str, remote: str | None = None) -> str:
                          (system units; `remote` sends it over ssh)
 
     `systemd-system` requires a NOPASSWD sudoers rule for that exact
-    command+argument on the target host. On .27 this is granted for
-    `systemctl start|stop|restart ollama` (see hosts/sam-4screen-desktop),
-    where `target` must match the rule verbatim: "ollama", not "ollama.service".
+    command+argument on the target host, and `target` must match the rule
+    verbatim (e.g. "foo", not "foo.service"). No service currently uses this
+    kind — it is kept as a tested capability.
 
     Note: sudo matches the *literal* PATH-resolved path, and NixOS puts a
     symlink (`/run/current-system/sw/bin/systemctl`) on PATH, so a bare

deploy/service-controller/services.toml

@@ -10,7 +10,8 @@
 #   systemd-system  -> sudo -n systemctl start/stop <target>  (system units; `remote`
 #                      sends it over ssh). Needs a matching NOPASSWD sudoers rule on
 #                      the target host, and `target` must match it verbatim
-#                      ("ollama", not "ollama.service").
+#                      (e.g. "foo", not "foo.service").
+#                      NOTE: no service currently uses this kind.
 #
 # group "media": family-facing editors (shared by everyone).
 # group "pipeline": photo ingestion (prefect worker + dashboard) — admin only.
@@ -98,19 +99,3 @@ label = "World Monitor"
 ram_mb = 120
 default_state = "running"
 who = ["sam"]
-
-# Ollama on .27 — now a NixOS *system* service (services.ollama in
-# hosts/sam-4screen-desktop/configuration.nix). The old user unit was deleted, so
-# this must be toggled with `sudo systemctl`, not `systemctl --user`. Bound to
-# 0.0.0.0:11434 for OmniRoute/dsh on .13. Models live in /var/lib/ollama/models.
-# RAM is the loaded model; OLLAMA_KEEP_ALIVE=5m unloads it when idle.
-[[services]]
-id = "ollama"
-kind = "systemd-system"
-target = "ollama"
-remote = "sam@192.168.20.27"
-group = "ai"
-label = "Local LLM Server (Ollama .27)"
-ram_mb = 9000
-default_state = "running"
-who = ["sam", "jo", "harry", "finn"]