refactor: remove Ollama integration and unused AI configuration

- Remove src/models/ollama_client.py, embeddings.py, embeddings_ollama.py
- Remove model aliases and AI config from settings (both config.py files)
- Update health endpoints to only check database connectivity
- Update tests to reflect database-only health checks
- Update README, .env.example, and OIDC docstrings

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/domains/auth/oidc.py

@@ -12,7 +12,6 @@ Permission Format: domain.category:action
 Examples:
 - control-room.general:admin - Full access to Control Room
 - media.general:viewer - View-only access to Media area
-- ai.ollama:user - User-level access to Ollama specifically (future)
 
 Action Hierarchy (higher implies lower):
 - admin > editor > user > viewer
@@ -554,7 +553,7 @@ def _extract_permissions_from_groups(groups: List[str]) -> List[str]:
     Examples:
     - tatlock-control-room-general-admin -> control-room.general:admin
     - tatlock-media-viewer -> media.general:viewer (shorthand)
-    - tatlock-ai-ollama-user -> ai.ollama:user
+    - tatlock-tools-dns-user -> tools.dns:user
 
     Args:
         groups: List of Authentik group names