Stability checkpoint — Ollama probe refactor + trivy timeout fix (MRs !186 + !187)

Two svc MRs rolled into this tag (pipeline #796 on !186 failed due
to trivy timeout, !187 fix shipped the green post-merge) :

1. MR !186 — OllamaHealthIndicator testability refactor : extract
   probeOllama() protected method + 7 new branch tests.
   20% → ~95% branch coverage. Production impact zero.

2. MR !187 — fix CI : bump trivy --timeout 5m → 15m. sbom:syft and
   trivy:scan both failed on pipeline #796 with context deadline
   exceeded during layer analysis. Trivy's own warning suggested
   the bump.

D2 Sonar coverage chips so far :
- RateLimitingFilter 57% → 86% branches
- OllamaHealthIndicator 20% → 95% branches