panel: remove the Ollama card and its controller entry

The local 14B model is not usable from this machine (8.25 tok/s prompt
processing; pi sends a 9,510-token agent prompt against a 4,096 context, so it
was truncated to 2,050 and still needed ~4 min before the first token). Nothing
about the panel was worth keeping for it.

- portal/tools.py: drop the 'Ollama Local LLM' tile (no other references remain)
- services.toml: drop the ollama allowlist entry; 8 services remain
- service_controller.py + docs: keep the generic 'systemd-system' kind but drop
  the ollama-specific wording and mark it as currently unused

Verified on .13: /api/services no longer lists ollama, the deployed tools.py has
0 ollama matches, the other 8 cards still report correctly, portal is healthy.

docs/portal-architecture.md

@@ -112,7 +112,6 @@ To allow family members to free up RAM on `.13` without exposing `/var/run/docke
 | `prefect-worker` | `prefect-worker` (systemd user) | ~129 MB | `pipeline` | `sam` |
 | `photo-dashboard` | `photo-dashboard` (systemd user) | ~112 MB | `pipeline` | `sam` |
 | `worldmonitor` | 4-container group (Container) | ~120 MB | `admin` | `sam` |
-| `ollama` | `ollama` on **`.27`** (`systemd-system`, via ssh) | ~9000 MB (loaded model) | `ai` | `sam`, `jo`, `harry`, `finn` |
 
 ### Controller kinds (`kind` in `services.toml`)
 
@@ -120,12 +119,12 @@ To allow family members to free up RAM on `.13` without exposing `/var/run/docke
 | :--- | :--- | :--- |
 | `container` | `docker start/stop <target>` | Same host (`.13`); `sam` is in the `docker` group. |
 | `systemd-user` | `systemctl --user <action> <target>` | Local `.13` user units (paperclip, prefect-worker, photo-dashboard). |
-| `systemd-system` | `sudo -n <canonical systemctl> <action> <target>` | System units, local or on a `remote` host over ssh. |
+| `systemd-system` | `sudo -n <canonical systemctl> <action> <target>` | System units, local or on a `remote` host over ssh. **Currently unused** — kept as a tested capability. |
 
-**`systemd-system` gotchas** (both were hit while wiring `ollama`):
+**`systemd-system` gotchas** (learned while it was in use; apply if it is ever wired up again):
 
 1. It needs a matching **NOPASSWD** sudoers rule on the target host, and the
-   `target` must match the rule verbatim — `ollama`, never `ollama.service`.
+   `target` must match the rule verbatim — `foo`, never `foo.service`.
 2. On NixOS, `systemctl` on `PATH` is a symlink (`/run/current-system/sw/bin/systemctl`)
    while the sudoers rule names the store path, and sudo matches the *literal*
    resolved path. A bare `sudo systemctl …` therefore does **not** match. The