fix(ollama): toggle the NixOS system service on .27, not the deleted user unit

The ollama card was wired to 'systemctl --user', but the .27 user unit was
removed when Ollama moved to services.ollama (NixOS system service). The panel
therefore reported Stopped while the service was Running and its buttons failed.

- new controller kind 'systemd-system' -> sudo -n <canonical systemctl> ...
- resolve systemctl to its store path first: NixOS puts a symlink on PATH but
  the NOPASSWD sudoers rule names the store path, so bare 'sudo systemctl' does
  not match (verified: full path exit=0, bare name 'a password is required')
- _remote() now shlex.join()s the remote command; ssh joins trailing argv with
  spaces, which was word-splitting the 'sh -c' wrapper and failing with a sudo
  usage error
- services.toml: ollama -> kind=systemd-system, target=ollama (matches the
  sudoers rule verbatim), default_state=running
- docs/portal-architecture.md: document the three controller kinds + gotchas

Verified end-to-end from .13: start->running, stop->stopped, start->running,
real systemctl agrees, and /v1/models lists both qwen2.5 models over the LAN.

deploy/service-controller/services.toml

@@ -5,8 +5,12 @@
 # voice/whisper/HA path, or n8n/prefect-server (shared infra, always on).
 #
 # kind:
-#   container   -> docker start/stop <target>   (sam is in the docker group)
-#   systemd-user-> systemctl --user start/stop <target>
+#   container       -> docker start/stop <target>   (sam is in the docker group)
+#   systemd-user    -> systemctl --user start/stop <target>   (local .13 user units)
+#   systemd-system  -> sudo -n systemctl start/stop <target>  (system units; `remote`
+#                      sends it over ssh). Needs a matching NOPASSWD sudoers rule on
+#                      the target host, and `target` must match it verbatim
+#                      ("ollama", not "ollama.service").
 #
 # group "media": family-facing editors (shared by everyone).
 # group "pipeline": photo ingestion (prefect worker + dashboard) — admin only.
@@ -95,13 +99,18 @@ ram_mb = 120
 default_state = "running"
 who = ["sam"]
 
+# Ollama on .27 — now a NixOS *system* service (services.ollama in
+# hosts/sam-4screen-desktop/configuration.nix). The old user unit was deleted, so
+# this must be toggled with `sudo systemctl`, not `systemctl --user`. Bound to
+# 0.0.0.0:11434 for OmniRoute/dsh on .13. Models live in /var/lib/ollama/models.
+# RAM is the loaded model; OLLAMA_KEEP_ALIVE=5m unloads it when idle.
 [[services]]
 id = "ollama"
-kind = "systemd-user"
-target = "ollama.service"
+kind = "systemd-system"
+target = "ollama"
 remote = "sam@192.168.20.27"
 group = "ai"
 label = "Local LLM Server (Ollama .27)"
 ram_mb = 9000
-default_state = "stopped"
+default_state = "running"
 who = ["sam", "jo", "harry", "finn"]