Update configuration and documentation for LLM support and local watchdog

- Added `ollama-models.yaml` to .gitignore and implemented logic to copy it in gpu-rent.ps1 and gpu-rent.sh.
- Enhanced env.example to include new variables for LLM runtime options and local watchdog configuration.
- Updated CLI commands to support LLM options during setup and execution, including new flags for Ollama and llama.cpp.
- Improved documentation in cli.md and README.md to reflect changes in LLM integration and local watchdog functionality.
- Adjusted architecture and decisions documentation to clarify the role of LLMs and local watchdog in the system.

src/gpu_rent/cloud.py

@@ -164,21 +164,35 @@ def ensure_security_group(conn, cidr: str, log: Callable[[str], None]) -> Any:
         except Exception as exc:
             raise _wrap(exc, "security group") from exc
 
-    # Ensure TCP/22 from operator CIDR (idempotent; old /32 from WARP may be stale).
+    # Ensure TCP/22 from operator CIDR; drop stale SSH /32s from old VPN/WARP IPs.
     have_cidr = False
+    stale_ssh: list[Any] = []
     try:
         for rule in conn.network.security_group_rules(security_group_id=sg.id):
             if (
-                getattr(rule, "direction", None) == "ingress"
-                and getattr(rule, "protocol", None) == "tcp"
-                and int(getattr(rule, "port_range_min", 0) or 0) == 22
-                and int(getattr(rule, "port_range_max", 0) or 0) == 22
-                and (getattr(rule, "remote_ip_prefix", None) or "") == cidr
+                getattr(rule, "direction", None) != "ingress"
+                or getattr(rule, "protocol", None) != "tcp"
+                or int(getattr(rule, "port_range_min", 0) or 0) != 22
+                or int(getattr(rule, "port_range_max", 0) or 0) != 22
             ):
+                continue
+            prefix = getattr(rule, "remote_ip_prefix", None) or ""
+            if prefix == cidr:
                 have_cidr = True
-                break
+            elif prefix:
+                stale_ssh.append(rule)
     except Exception:
         have_cidr = False
+        stale_ssh = []
+
+    for rule in stale_ssh:
+        old = getattr(rule, "remote_ip_prefix", None) or "?"
+        try:
+            conn.network.delete_security_group_rule(rule.id)
+            log(f"SG {SG_NAME}: − устаревший TCP/22 с {old}")
+        except Exception as exc:
+            log(f"SG {SG_NAME}: не удалить stale {old}: {exc}")
+
     if not have_cidr:
         try:
             conn.network.create_security_group_rule(