fix(api): let the Dockerized proxy reach a host-run Ollama

After the prompts fix, /dm/narrate reached the model call and failed with
ConnectError: Connection refused — the container's localhost is not the
host, so the default OLLAMA_BASE_URL=http://localhost:11434 hit nothing.
Ollama runs on the host (M1's venv smoke reached it because uvicorn ran on
the host too; the container never had a route).

Add extra_hosts host.docker.internal:host-gateway so the container can
reach the host, and document using http://host.docker.internal:11434 in
.env.example. Verified a container reaches host Ollama's /api/tags (200).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

api/.env.example

@@ -2,6 +2,10 @@
 # any of these — keys live only in the proxy (charter §4).
 
 # Where the proxy sends model calls in dev (Ollama on the homelab).
+# Running the proxy IN DOCKER with Ollama on THIS host? localhost points at the
+# container, not the host — use http://host.docker.internal:11434 instead
+# (docker-compose.yml maps that name via host-gateway). Bare-metal/venv: keep
+# localhost. Homelab Ollama: use its address.
 OLLAMA_BASE_URL=http://localhost:11434
 
 # Prod model provider (charter §4). Leave blank in dev.

docker-compose.yml

@@ -14,6 +14,12 @@ services:
         required: false
     environment:
       PORT: 8000
+    # Reach a host-run Ollama from inside the container. On Linux, localhost in
+    # the container is the container itself, so OLLAMA_BASE_URL must be
+    # http://host.docker.internal:11434 (set in api/.env); this maps that name
+    # to the Docker host. Harmless when Ollama is on the homelab instead.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     # Mount source + prompts + schemas so edits are live without a rebuild.
     # Prompts are source code (§16) — editing a prompt should reload like code.
     volumes: