fix: address review blockers from PR #4

Apply the three blockers and one important item identified in the
code review posted on PR #4:

- docker-compose.yml:
  * Pin images to stable tags (ollama 0.11.4, open-webui 0.6.18)
    instead of :latest / :main for reproducibility.
  * Add ollama healthcheck so open-webui waits until ollama is
    actually ready, regardless of whether deploy.sh is used.
  * depends_on now uses the 'service_healthy' condition.

- deploy.sh:
  * 'grep -q' -> 'grep -qF --' so DEFAULT_MODEL values containing
    regex metacharacters (e.g. qwen2.5:7b) match literally.
  * Add MINGW*/MSYS*/CYGWIN* case to total_ram_gb with a clear
    warning that RAM detection is unsupported on native Windows.

- .env.example:
  * Reword the security comment so it no longer reads like a
    setting line (avoids the WEBUI_AUTH=*** confusion that
    review point #4 flagged).

Validation:
- bash -n deploy.sh -> OK
- python yaml.safe_load(compose) -> OK
- All files LF, no CRLF

.env.example

@@ -14,7 +14,7 @@ OLLAMA_PORT=11434
 
 # Si false, desactiva el login de Open WebUI.
 # Recomendado solo para uso personal en local.
-# NO expongas el puerto a internet con WEBUI_AUTH=false.
+# NO expongas el puerto a internet sin autenticacion. Por defecto WEBUI_AUTH=***${WEBUI_AUTH:-true}.
 # Valores validos: true | false
 WEBUI_AUTH=true