fix(ollama): toggle the NixOS system service on .27, not the deleted user unit

The ollama card was wired to 'systemctl --user', but the .27 user unit was
removed when Ollama moved to services.ollama (NixOS system service). The panel
therefore reported Stopped while the service was Running and its buttons failed.

- new controller kind 'systemd-system' -> sudo -n <canonical systemctl> ...
- resolve systemctl to its store path first: NixOS puts a symlink on PATH but
  the NOPASSWD sudoers rule names the store path, so bare 'sudo systemctl' does
  not match (verified: full path exit=0, bare name 'a password is required')
- _remote() now shlex.join()s the remote command; ssh joins trailing argv with
  spaces, which was word-splitting the 'sh -c' wrapper and failing with a sudo
  usage error
- services.toml: ollama -> kind=systemd-system, target=ollama (matches the
  sudoers rule verbatim), default_state=running
- docs/portal-architecture.md: document the three controller kinds + gotchas

Verified end-to-end from .13: start->running, stop->stopped, start->running,
real systemctl agrees, and /v1/models lists both qwen2.5 models over the LAN.

docs/portal-architecture.md

@@ -112,6 +112,28 @@ To allow family members to free up RAM on `.13` without exposing `/var/run/docke
 | `prefect-worker` | `prefect-worker` (systemd user) | ~129 MB | `pipeline` | `sam` |
 | `photo-dashboard` | `photo-dashboard` (systemd user) | ~112 MB | `pipeline` | `sam` |
 | `worldmonitor` | 4-container group (Container) | ~120 MB | `admin` | `sam` |
+| `ollama` | `ollama` on **`.27`** (`systemd-system`, via ssh) | ~9000 MB (loaded model) | `ai` | `sam`, `jo`, `harry`, `finn` |
+
+### Controller kinds (`kind` in `services.toml`)
+
+| `kind` | How it acts | Notes |
+| :--- | :--- | :--- |
+| `container` | `docker start/stop <target>` | Same host (`.13`); `sam` is in the `docker` group. |
+| `systemd-user` | `systemctl --user <action> <target>` | Local `.13` user units (paperclip, prefect-worker, photo-dashboard). |
+| `systemd-system` | `sudo -n <canonical systemctl> <action> <target>` | System units, local or on a `remote` host over ssh. |
+
+**`systemd-system` gotchas** (both were hit while wiring `ollama`):
+
+1. It needs a matching **NOPASSWD** sudoers rule on the target host, and the
+   `target` must match the rule verbatim — `ollama`, never `ollama.service`.
+2. On NixOS, `systemctl` on `PATH` is a symlink (`/run/current-system/sw/bin/systemctl`)
+   while the sudoers rule names the store path, and sudo matches the *literal*
+   resolved path. A bare `sudo systemctl …` therefore does **not** match. The
+   controller resolves `systemctl` to its canonical store path first, which also
+   survives nixpkgs bumps that change the systemd store hash.
+3. `_remote()` quotes the remote command with `shlex.join` before handing it to
+   ssh, because ssh joins its trailing argv with spaces before the remote shell
+   parses it.
 
 ---