Update configuration and documentation for LLM support and local watchdog

- Added `ollama-models.yaml` to .gitignore and implemented logic to copy it in gpu-rent.ps1 and gpu-rent.sh.
- Enhanced env.example to include new variables for LLM runtime options and local watchdog configuration.
- Updated CLI commands to support LLM options during setup and execution, including new flags for Ollama and llama.cpp.
- Improved documentation in cli.md and README.md to reflect changes in LLM integration and local watchdog functionality.
- Adjusted architecture and decisions documentation to clarify the role of LLMs and local watchdog in the system.

src/gpu_rent/idle_killer.py

@@ -54,12 +54,45 @@ def create_application_credential(conn, cfg: Config, server_id: str, log: Log) -
             name=name,
             secret=secret,
             description="gpu-rent idle-killer: delete this compute",
+            access_rules=[
+                {
+                    "service": "compute",
+                    "method": "DELETE",
+                    "path": f"/v2.1/servers/{server_id}",
+                },
+                {
+                    "service": "compute",
+                    "method": "DELETE",
+                    "path": "/v2.1/servers/*",
+                },
+                # sdk may GET server before delete / confirm status
+                {
+                    "service": "compute",
+                    "method": "GET",
+                    "path": f"/v2.1/servers/{server_id}",
+                },
+                {
+                    "service": "compute",
+                    "method": "GET",
+                    "path": "/v2.1/servers/*",
+                },
+            ],
         )
     except Exception as exc:
-        raise CloudError(
-            f"не создать application credential: {exc}. "
-            "Нужны права identity:application_credential_create на сервисного пользователя."
-        ) from exc
+        # Selectel / older Keystone may reject access_rules — fall back unrestricted delete.
+        log(f"app cred с access_rules не вышло ({exc}); пробуем без правил")
+        try:
+            ac = conn.identity.create_application_credential(
+                user=user_id,
+                name=name,
+                secret=secret,
+                description="gpu-rent idle-killer: delete this compute",
+            )
+        except Exception as exc2:
+            raise CloudError(
+                f"не создать application credential: {exc2}. "
+                "Нужны права identity:application_credential_create на сервисного пользователя."
+            ) from exc2
     ac_id = getattr(ac, "id", None) or (ac.get("id") if isinstance(ac, dict) else None)
     ac_secret = getattr(ac, "secret", None) or secret
     if not ac_id: