fix: address review blockers from PR #4

Apply the three blockers and one important item identified in the
code review posted on PR #4:

- docker-compose.yml:
  * Pin images to stable tags (ollama 0.11.4, open-webui 0.6.18)
    instead of :latest / :main for reproducibility.
  * Add ollama healthcheck so open-webui waits until ollama is
    actually ready, regardless of whether deploy.sh is used.
  * depends_on now uses the 'service_healthy' condition.

- deploy.sh:
  * 'grep -q' -> 'grep -qF --' so DEFAULT_MODEL values containing
    regex metacharacters (e.g. qwen2.5:7b) match literally.
  * Add MINGW*/MSYS*/CYGWIN* case to total_ram_gb with a clear
    warning that RAM detection is unsupported on native Windows.

- .env.example:
  * Reword the security comment so it no longer reads like a
    setting line (avoids the WEBUI_AUTH=*** confusion that
    review point #4 flagged).

Validation:
- bash -n deploy.sh -> OK
- python yaml.safe_load(compose) -> OK
- All files LF, no CRLF

deploy.sh

@@ -61,6 +61,11 @@ total_ram_gb() {
     Darwin)
       sysctl -n hw.memsize | awk '{printf "%d\n", $1/1024/1024/1024}'
       ;;
+    MINGW*|MSYS*|CYGWIN*)
+      warn "Deteccion de RAM no soportada en Windows nativo."
+      warn "Usa WSL2 o asume 8 GB como baseline seguro."
+      echo "0"
+      ;;
     *)
       echo "0"
       ;;
@@ -86,9 +91,11 @@ until docker exec d0a1-ollama ollama list >/dev/null 2>&1; do
   fi
 done
 
+# grep -qF hace match literal (sin regex), evitando que un punto en el
+# nombre del modelo (p.ej. qwen2.5:7b) actue como wildcard.
 # --- Modelo por defecto ------------------------------------------------------
 
-if ! docker exec d0a1-ollama ollama list | grep -q "$DEFAULT_MODEL"; then
+if ! docker exec d0a1-ollama ollama list | grep -qF -- "$DEFAULT_MODEL"; then
   info "Descargando modelo por defecto: $DEFAULT_MODEL"
   if [ "$RAM_GB" -gt 0 ] && [ "$RAM_GB" -lt 8 ]; then
     warn "Detectados ${RAM_GB} GB de RAM. Para este modelo se recomiendan 8 GB."