feat(ai): enforce local-first routing

Keep external providers behind server consent, task, and prompt-cost gates while persisting actual provider provenance.

.env.example

@@ -48,13 +48,19 @@ AI_SERVICE_TOKEN=
 OLLAMA_BASE_URL=http://ollama:11434
 OLLAMA_MODEL=qwen2.5:7b
 
-# AI provider for the heavy /cv/* calls: ollama (default, local) | gemini | groq.
-# External processing is denied unless the administrator gate below is true AND
-# the authenticated Pro user has explicitly opted in under Settings. /summarize
-# always stays local (distilbart).
+# Optional external fallback provider for heavy /cv/* calls: ollama (none) | gemini | groq.
+# Local Ollama is always attempted first unless the explicitly configured mode is
+# external_only. External processing still requires the administrator gate, an
+# allowed task, and the authenticated Pro user's opt-in. /summarize stays local.
 # Keys are read from the environment only — never commit real keys.
 AI_PROVIDER=ollama
 EXTERNAL_AI_ENABLED=false
+AI_ROUTING_MODE=local_first
+EXTERNAL_AI_ALLOWED_TASKS=cv-normalize,cv-classify,cv-rewrite
+# Per-request cost/privacy ceiling. Requests above this size remain local even after local failure.
+EXTERNAL_AI_MAX_PROMPT_CHARS=24000
+LOCAL_AI_CIRCUIT_FAILURE_THRESHOLD=3
+LOCAL_AI_CIRCUIT_OPEN_SECONDS=30
 GEMINI_API_KEY=
 GEMINI_MODEL=gemini-2.0-flash
 GROQ_API_KEY=