feat: self-hosted LLM backend — point all workflows at the Jetson (Ollama, model=coder)

The Jetson Orin Nano (JetPack 7.2, Ollama on GPU) is live, so ci-ai runs fully
self-hosted: no Anthropic key, no cloud, no per-PR cost. AI_PROVIDER=ollama,
AI_BASE_URL=http://192.168.178.103:11434/v1. The Pi runner reaches it LAN-direct
(SNAT to .48, allowed by the Jetson UFW). Removed the dead ANTHROPIC_API_KEY
secret declarations.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/reusable-security.yml

@@ -8,17 +8,14 @@
 # Voraussetzungen (einmalig zentral):
 #   - Runner instanzweit registriert (Label `eulernest`)
 #   - anonymer Clone für public Repos erlaubt (für den ci-ai-Clone)
-#   - optional ANTHROPIC_API_KEY als Org-/Instanz-Secret (für die KI-Erklärung)
+#   - KI-Backend = Jetson-Ollama (self-hosted, LAN); kein Secret nötig
 #
 # python:3.12-slim (Debian: bash) + Memory-Cap (Pi). ⚠ ARM64-Binaries.
 # Gitleaks (Secrets) + Trivy config (IaC) — hart blockierend über den Gate-Schritt.
 name: ci-ai · security (reusable)
 
 on:
-  workflow_call:
-    secrets:
-      ANTHROPIC_API_KEY:
-        required: false
+  workflow_call: {}
 
 env:
   GITLEAKS_VERSION: "8.18.4"
@@ -74,9 +71,9 @@ jobs:
         if: failure()
         continue-on-error: true
         env:
-          AI_PROVIDER: anthropic
-          AI_MODEL: claude-3-5-haiku-latest
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          AI_PROVIDER: ollama
+          AI_MODEL: coder
+          AI_BASE_URL: http://192.168.178.103:11434/v1
           GITEA_TOKEN: ${{ github.token }}
           GITEA_API: https://git.eulernest.eu/api/v1
         run: |