feat: initial llm-chat v0.1.0 (llm.chat@0.1.0)

Generic Ollama-compatible LLM chat adapter. The lower-level
counterpart to orchestrator-llm: orchestrator-llm wraps the LLM
in a planning prompt that emits a structured F∆I Plan; this
module is the plain-prompt adapter that flows compose for
summarisation, translation, free-form Q&A, etc.

Capability surface:

  Inputs:
    prompt        : text
    endpoint      : text   (Ollama /api/chat URL)
    model         : text
    api_key       : text   (optional bearer token)
    system_prompt : text   (optional)

  Outputs:
    response       : text   (assistant reply)
    model_endpoint : text   (audit correlation)
    model_name     : text   (audit correlation)
    model_digest   : text   (Ollama /api/show probe; empty
                              for non-Ollama or transient failures)

  Permissions: net to localhost / 127.0.0.1 / api.openai.com /
               api.anthropic.com.

The audit-field trio (endpoint + name + digest) closes the same
forensic gap that orchestrator-llm v0.3.1 closed for plan
generation: any historical chat invocation can be traced to the
exact model that produced it.

Implementation reuses the same defensive Ollama client pattern
from orchestrator-llm — derive_show_url + extract_show_digest
+ best-effort probe_model_digest. Duplication accepted at the
two-module mark; a shared crate refactor lands once a third
module needs the same plumbing.

12 host-side tests cover prompt building, Ollama-shaped
response parsing, URL transform, digest extraction (top-level
+ nested), end-to-end success, end-to-end probe-failure
swallow, end-to-end skip-for-non-Ollama, and the missing-input
guards.

Wasm artifact: 294 KB. Verified to build with v1.0 fai:platform
imports baked in.

Bootstrapped via 'fai new module llm.chat' (workspace v0.10.13)
which now produces an SDK-based template directly.

Signed-off-by: flemming-it <sf@flemming.it>

.forgejo/workflows/ci.yml

@@ -0,0 +1,85 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      # Manual external-URL checkout — see fai/platform CI for
+      # background. Lays this repo at $GITHUB_WORKSPACE.
+      - name: Checkout text-extract via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      # The fai-module-sdk dependency is a git dep against a repo
+      # that lives in another Forgejo org. The repo-scoped
+      # GITHUB_TOKEN cannot read it, and the Forgejo instance has
+      # REQUIRE_SIGNIN_VIEW=true so anonymous read is also denied.
+      # MODULE_SDK_PAT is a stored secret with read access to
+      # fai/module-sdk; we inject it into any outgoing
+      # https://git.flemming.ws/ URL via insteadOf so cargo's git
+      # fetch (driven by CARGO_NET_GIT_FETCH_WITH_CLI) authenticates
+      # transparently.
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl \
+            ca-certificates \
+            build-essential \
+            pkg-config \
+            libssl-dev \
+            git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y \
+              --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 \
+              --component rustfmt \
+              --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2