Add S3 mirror path for Ollama models + mirror-ollama-model.sh helper

Three pieces:

1. mirror-ollama-model.sh — run on any machine that has the model
   pulled. Parses the manifest at
   ~/.ollama/models/manifests/registry.ollama.ai/<ns>/<name>/<tag>,
   greps every sha256:* digest, tars manifest + referenced blobs into
   one .tgz. Output is portable — extract over any other Ollama
   data dir and the model is immediately visible.

2. init-models.sh gains an s3_pull function that curls a tarball from
   $S3_OLLAMA_BASE and extracts into /root/.ollama/models/. Falls back
   to ollama pull when S3_OLLAMA_BASE is unset, so s3_pull lines are
   safe to commit before the bucket is ready. huihui_ai/qwen3.5-
   abliterated:9b promoted to s3_pull as the example.

3. docker-compose.yml model-init service propagates S3_OLLAMA_BASE
   from .env. Curl auto-installs at script start because ollama/ollama
   doesn't always ship it.

README documents the mirror workflow under "Mirroring models to S3".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deployments/ai-stack/.env.example

@@ -27,3 +27,11 @@ COMFYUI_IMAGE_TAG=latest
 # gated repos (Flux-dev, SD3, etc.). Generate a read token at
 # https://huggingface.co/settings/tokens. Leave empty for public-only.
 HF_TOKEN=
+
+# HTTPS base URL of an S3 bucket / CDN that hosts mirrored Ollama model
+# tarballs (created by mirror-ollama-model.sh). Files under this base are
+# fetched by init-models.sh's s3_pull instead of registry.ollama.ai —
+# faster and immune to upstream rate-limiting / removal. Example:
+#   S3_OLLAMA_BASE=https://your-bucket.s3.amazonaws.com/ollama-models
+# Leave empty to fall back to plain `ollama pull` for everything.
+S3_OLLAMA_BASE=