Restrict the AI tab to HOST1 — the only node with the GPU, Ollama and the index

Plugin/unraid/include/config.php

@@ -43,7 +43,8 @@
 //       Shared config still resolves; host-specific values are simply absent.
 //
 // EXPORTS
-//   Identity      vv_detect_host(), vv_get_hostname(), vv_is_owner(), vv_known_hosts()
+//   Identity      vv_detect_host(), vv_get_hostname(), vv_is_owner(), vv_is_ai_host(),
+//                 vv_known_hosts()
 //   Config        vv_conf_vars(), vv_read_conf_raw(), vv_write_conf_raw(), vv_get_conf_files()
 //   Parsing       vv_parse_conf_scalar(), vv_parse_kv_db(), vv_format_uptime()
 //   Remote        vv_resolve_tailscale_ip(), vv_remote_state_cmd(), vv_local_ip()
@@ -257,6 +258,16 @@ function vv_is_owner(): bool {
     return vv_detect_host() === 'host1';
 }
 
+// The AI subsystem is HOST1-only: it is the node with the GPU, the Ollama process and the
+// index. Deliberately a separate predicate from vv_is_owner() even though both resolve to
+// host1 today — one says "auth source of truth", this one says "AI runs here", and the day
+// either moves, conflating them would move the other by accident.
+//
+// Returns false for 'unknown', so a host that cannot identify itself never shows the tab.
+function vv_is_ai_host(): bool {
+    return vv_detect_host() === 'host1';
+}
+
 function vv_read_conf_raw(string $filename): string {
     $path = CONF_DIR . '/' . $filename;
     return file_exists($path) ? file_get_contents($path) : '';