fix(infra): make prod Ollama model-init offline-safe

The init command unconditionally ran `ollama pull`, which contacts the
registry to verify the manifest digest even when the model is already on
the volume. A host reboot during a registry/upstream-network blip would
then fail init non-zero, the `service_completed_successfully` gate would
never be met, and the ollama service (hence NL search) would stay down
until the registry was reachable again.

Guard the pull with `ollama list | grep -q <model>` so a cached model
exits clean without any registry round-trip.

Addresses #759 review (Tobias #1).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -206,13 +206,17 @@ services:
   # first start; exits quickly on subsequent starts (model already cached).
   # The ollama/ollama image's ENTRYPOINT is `ollama` and the image ships WITHOUT
   # curl, so the entrypoint is overridden to a shell and readiness is probed with
-  # `ollama list` (not curl). Backend degrades gracefully (503) if Ollama is absent.
+  # `ollama list` (not curl). The pull is guarded by a `grep` on the cached model
+  # list so a model already on the volume exits clean WITHOUT a registry round-trip
+  # — a host reboot during a registry/network blip can no longer fail init (which
+  # would block the ollama service via service_completed_successfully).
+  # Backend degrades gracefully (503) if Ollama is absent.
   ollama-model-init:
     image: ollama/ollama:0.30.6
     restart: "no"
     entrypoint: ["/bin/sh", "-c"]
     command:
-      - "ollama serve & until ollama list >/dev/null 2>&1; do sleep 1; done && ollama pull qwen2.5:7b-instruct-q4_K_M"
+      - "ollama serve & until ollama list >/dev/null 2>&1; do sleep 1; done && (ollama list | grep -q 'qwen2.5:7b-instruct-q4_K_M' || ollama pull qwen2.5:7b-instruct-q4_K_M)"
     networks:
       - archiv-net
     volumes: