fix(security): grant private AI endpoints by exact origin, dialled pinned

ALLOW_LOCAL_AI_PRIVATE_HOSTS=true let any user of the instance point the
Local provider or the OpenAI-compatible gateway at any private address
the server could reach, the metadata range included, and a granted host
was dialled with no connect-time pin at all.

AI_PRIVATE_ORIGINS grants a private AI endpoint with the exact-origin
grammar NOTIFICATION_PRIVATE_ORIGINS and NIGHTSCOUT_PRIVATE_ORIGINS use.
A granted call goes through the pinned operator-approved dispatcher:
redirects forbidden, and metadata, link-local and unspecified answers
dropped at dial time even for a granted name. Everything else stays on
the public pin. The Local client (buffered and streaming) and the
gateway and admin-key tags of the OpenAI client all take their policy
from one function.

The host-list form of ALLOW_LOCAL_AI_PRIVATE_HOSTS keeps working with the
same pinning; a never-grantable literal or a host:port entry is refused
with a one-time warning. Its "true" form grants nothing any more and is
reported in the boot readiness summary with the replacement.

A failed lab-report scan no longer puts the endpoint's response body into
the wide event; status and model stay. The response to the caller never
carried it.

docker-compose.yml

@@ -253,12 +253,16 @@ x-healthlog-env: &healthlog_env
   # container (the `environment:` block is a whitelist). See
   # docs/ops/tls-cert-pin.md.
   TLS_LEAF_SPKI_PINS: "${TLS_LEAF_SPKI_PINS:-}"
-  # Local-AI SSRF opt-in (optional). The local AI provider rejects
-  # private/internal hosts by default; set this to an exact host allowlist
-  # (e.g. "ollama.lan,10.0.0.5") or "true" for any private host, intended
-  # for a self-hosted Ollama / LM Studio. Listed here so an operator value
-  # in .env reaches the container (the `environment:` block is a whitelist).
-  # See docs/integrations/ai-providers.md.
+  # AI endpoints on your own network (optional): a self-hosted Ollama,
+  # LM Studio or LiteLLM gateway, comma-separated exact origins (e.g.
+  # "http://ollama.lan:11434,http://10.0.0.5:4000"). Without it an AI base
+  # URL on a private address is refused. Link-local, metadata and
+  # unspecified addresses stay refused even when listed. See
+  # docs/integrations/ai-providers.md.
+  AI_PRIVATE_ORIGINS: "${AI_PRIVATE_ORIGINS:-}"
+  # Older form of the above, kept for existing installs: an exact host list
+  # (e.g. "ollama.lan,10.0.0.5") still works. Its "true" form no longer
+  # opens every private host; move to AI_PRIVATE_ORIGINS.
   ALLOW_LOCAL_AI_PRIVATE_HOSTS: "${ALLOW_LOCAL_AI_PRIVATE_HOSTS:-}"
   # Extra hosts the admin-configured AI base URL may point at, on top of the
   # built-in public providers. Comma-separated bare hostnames. Set it when