v0.3.0: 82 models, local TTS, nginx rate limiting, security hardening

Models:
- add ollama: qwen3:4b, smollm2:1.7b, qwen2.5-coder:3b, bge-m3, qwen3-embedding:0.6b
- add speaches: whisper, parakeet transcription, Kokoro TTS
- 82 models across 12 providers

Infrastructure:
- speaches-pull container pre-downloads whisper, parakeet-onnx, kokoro-int8
- ollama-pull DNS fix: network_mode service:ollama
- litellm workers configurable via LITELLM_WORKERS env var
- speaches healthcheck fixed (/health not /healthz)
- remove litellm memory limits

Security:
- nginx rate limiting on all endpoints (api 120r/m, storage 60r/m, claudebox/browser 30r/m)
- Cloudflare real IP restoration (CF-Connecting-IP) so rate limits work behind tunnel
- HAProxy __queue/health and __queue/status restricted to private networks
- default auth tokens to lulz-4-security (stealthy-auto-browse, hybrids3)