feat: dynamic Ollama model discovery + second phase features

Backend:
- Add GET /chat/models/ollama endpoint for dynamic local model discovery
- Add preferred_ollama_model column to user_profiles
- Fix privacy strict mode to use preferred/detected Ollama model
- Accept any ollama-* model ID in resolveModel()
- Export getOllamaHost() and listOllamaModels() from ollama.ts
- Add CORS support for 127.0.0.1:3000 origin
- Copy second_phase migration to supabase/migrations/

Frontend:
- ModelToggle: dynamically fetch and display local Ollama models
- modelAvailability: add ollama provider (no API key needed)
- useSelectedModel: accept dynamic ollama-* IDs
- UserProfileContext: expose ollamaHost and preferredOllamaModel
- Account models page: add Ollama host + preferred model config UI
- Skip API-key modal for Ollama models in chat/TabularReview

Also includes prior second phase work:
- i18n (de/fr/it/en) with next-intl, localePrefix: never
- Canton selector per-chat with canton context injection
- Agent/persona system (20 agents) with per-chat agent selection
- Privacy scanner for privilege detection
- Ollama provider for local LLM inference
- Backend tests (43 passing) + Playwright E2E tests (3 passing)
- Local Supabase dev setup with .env config