Split Ollama into its own Deployment, with optional GPU

[krlex]

Renders the assistant's model server as its own Deployment, matching the split
made in forail-assistant.

What changed

• forail-assistant-ollama Deployment + Service + its own PVC. Model blobs are
  far larger than the vector index and outlive a rebuild of the API, so keeping
  the claims apart means the index PVC is sized by the corpus, not the model.
• assistant.ollama.gpu.enabled requests nvidia.com/gpu on that pod alone —
  only the model server has to land on a GPU node, the API stays schedulable
  anywhere. Off by default: the request pins the pod to a node advertising the
  device, so without one it stays Pending.
• images.assistantOllama pinned to ollama/ollama:0.30.10, for the same reason
  the application image stopped tracking latest.
• The Service is ClusterIP; Ollama has no authentication, so only the API reaches it.
• Chart README gained an assistant section — it previously did not mention the
  assistant at all, so the new values were undiscoverable.

Breaking — read before upgrading

assistant.storage.size drops 20Gi → 5Gi now that models live on their own
claim. PVCs cannot shrink, so an existing install with assistant.enabled=true
fails the upgrade on the immutable field. Two ways out:

• delete the forail-assistant-data claim — the vector index rebuilds itself
  from docs_to_index/, nothing irreplaceable is stored there; or
• keep the old size: --set assistant.storage.size=20Gi.

Fresh installs need no action.

Verified

• helm lint clean.
• Renders with assistant.enabled=true --set assistant.ollama.gpu.enabled=true
  and puts nvidia.com/gpu: 1 on the ollama pod only.
• With the assistant disabled, no ollama resources are rendered at all.

Pairs with the matching change in forail-assistant.