Add AI entry points, conf schema, and folder docs

ai_index.sh and ai_query.sh follow the usual conventions — fail-closed gate,
root check, lock, dry-run, status — with Node doing only the vector maths and
SQLite blobs, the same split api_cache_writer.sh uses for PHP.

AI_* and HOST*_OLLAMA_* land in both confs and both templates in this pass.
Everything ships off: AI_ENABLED false, every AI_ASSIST_* false, conf writes
disabled with an empty whitelist. Nothing in the ecosystem consults it.

Deployment/host.conf.template

@@ -569,6 +569,20 @@
     HOSTN_LLDAP_USER="admin"                    # lldap admin username
     HOSTN_LLDAP_PASS=""                         # lldap admin password
 
+
+# ==============================================================================================
+# ── Ollama / AI ───────────────────────────────────────────────────────────────────────────────
+# ==============================================================================================
+# Per-host because only some nodes actually have a GPU. A node with an empty OLLAMA_URL is not
+# an error — it falls through to the resolver and uses another node's Ollama over Tailscale.
+
+# ━━━ Ollama ━━━
+    HOSTN_OLLAMA_URL=""                          # e.g. http://localhost:11434 — empty if no local Ollama
+    HOSTN_OLLAMA_CONTAINER="Ollama"              # for watchdog / restart lists
+    HOSTN_OLLAMA_GPU_UUID=""                     # pins Ollama to one card on multi-GPU hosts
+    HOSTN_OLLAMA_MODEL="qwen2.5-coder:14b"       # generation
+    HOSTN_OLLAMA_EMBED_MODEL="nomic-embed-text"  # embeddings — the generation model cannot embed
+
 # ━━━ Authelia ━━━
     HOSTN_AUTHELIA_CONFIG="/mnt/user/appdata-Fallback/Critical-Data/Authelia/configuration.yml"
     HOSTN_AUTHELIA_CONTAINER="Authelia"

Deployment/master.conf.template

@@ -1593,6 +1593,54 @@
     SYS_WATCHDOG_ABORT_ON_PARITY=false           # aborting parity better than crashing mid-check
     SYS_WATCHDOG_ABORT_ON_MOVER=false            # aborting move better than crashing mid-move
 
+# ==============================================================================================
+# ── AI / RAG ──────────────────────────────────────────────────────────────────────────────────
+# ==============================================================================================
+# Varaverk works exactly as well with AI off as with it on. Nothing below is required for any
+# script to function — every feature that can lean on AI has a complete non-AI path, and the
+# AI path is an enhancement layered on top. If Ollama is unreachable, callers proceed without it.
+#
+# AI_ENABLED is necessary but not sufficient. Every feature stays individually off until it has
+# earned it — narration for months before anything is allowed near a decision.
+
+# ━━━ AI Master Switch ━━━
+# Fail-closed: anything other than the literal "true" means off.
+    AI_ENABLED=false
+    AI_CONNECT_TIMEOUT=5            # seconds — probe when resolving which node has Ollama
+    AI_REQUEST_TIMEOUT=240          # seconds — must clear a cold model load
+    AI_RESOLVE_CACHE_TTL=300        # seconds — don't re-probe the mesh every invocation
+    AI_MAX_RETRIES=1                # AI is enhancement; do not retry hard
+
+# ━━━ AI Retrieval Index ━━━
+# The RAG index over this repo's own headers and documentation. Regenerable in minutes and
+# gitignored — it is derived data, never a source of truth.
+#
+# Only git-tracked files are ever indexed. Configurations/, State_Files/ and data/ are
+# gitignored, which is what makes it structurally impossible for a credential to reach the
+# index: the files holding them were never in the repo. Do not "improve" this to a filesystem
+# walk — an embedded secret cannot be rotated out of a vector.
+    AI_INDEX_DB="$DATA_DIR/ai_index.db"
+    AI_INDEX_BATCH=32               # chunks per embed request
+    AI_INDEX_ON_PULL=false          # re-index after a successful git pull once AI is in use
+    AI_SEARCH_K=8                   # chunks retrieved per query
+    AI_SEARCH_PER_FILE=3            # cap per file so one document cannot fill the context
+
+# ━━━ AI Feature Toggles ━━━
+# Tier 1 is narration — it cannot change a decision. Tier 2 adds context to a decision a script
+# already made. Tier 3 assists a human. Enable in that order, and give each one weeks.
+    AI_ASSIST_REPORTS=false         # tier 1 — digest / coffee report narration
+    AI_ASSIST_WATCHDOG=false        # tier 2 — context on a flagged condition
+    AI_ASSIST_DISCOVERY=false       # tier 2 — discovery / classification judgement calls
+    AI_ASSIST_CLEANUP=false         # tier 2 — orphan and stuck-import triage
+    AI_ASSIST_ONBOARD=false         # tier 3 — onboarding / settings assistance
+
+# ━━━ AI Conf Write Access ━━━
+# Separate switch from AI_ENABLED, off by default, and an explicit key whitelist. Never paths,
+# never credentials, never a container name. An empty whitelist means no writes regardless of
+# the toggle.
+    AI_CONF_WRITE_ENABLED=false
+    AI_CONF_WRITE_KEYS=()
+
 # ==============================================================================================
 # ──────────────────────── End Of User Variables ───────────────────────────────────────────────
 # ==============================================================================================