fix: address review blockers from PR #4

Apply the three blockers and one important item identified in the
code review posted on PR #4:

- docker-compose.yml:
  * Pin images to stable tags (ollama 0.11.4, open-webui 0.6.18)
    instead of :latest / :main for reproducibility.
  * Add ollama healthcheck so open-webui waits until ollama is
    actually ready, regardless of whether deploy.sh is used.
  * depends_on now uses the 'service_healthy' condition.

- deploy.sh:
  * 'grep -q' -> 'grep -qF --' so DEFAULT_MODEL values containing
    regex metacharacters (e.g. qwen2.5:7b) match literally.
  * Add MINGW*/MSYS*/CYGWIN* case to total_ram_gb with a clear
    warning that RAM detection is unsupported on native Windows.

- .env.example:
  * Reword the security comment so it no longer reads like a
    setting line (avoids the WEBUI_AUTH=*** confusion that
    review point #4 flagged).

Validation:
- bash -n deploy.sh -> OK
- python yaml.safe_load(compose) -> OK
- All files LF, no CRLF

docker-compose.yml

@@ -1,6 +1,7 @@
 services:
   ollama:
-    image: ollama/ollama:latest
+    # Pin a version estable conocida. Cambiar junto con .env.example / README.
+    image: ollama/ollama:0.11.4
     container_name: d0a1-ollama
     restart: unless-stopped
     ports:
@@ -9,17 +10,24 @@ services:
       - ollama_data:/root/.ollama
     environment:
       - OLLAMA_KEEP_ALIVE=${OLLAMA_KEEP_ALIVE:-5m}
-    # GPU passthrough: descomenta la sección deploy si tienes GPU NVIDIA
+    healthcheck:
+      test: ["CMD", "ollama", "list"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
+    # GPU passthrough: descomenta la seccion deploy si tienes GPU NVIDIA.
     # deploy:
     #   resources:
     #     reservations:
     #       devices:
     #         - driver: nvidia
-    #           count: all
-    #           capabilities: [gpu]
+    #         count: all
+    #         capabilities: [gpu]
 
   open-webui:
-    image: ghcr.io/open-webui/open-webui:main
+    # Pin a version estable. La imagen :main se rompe sin aviso.
+    image: ghcr.io/open-webui/open-webui:0.6.18
     container_name: d0a1-open-webui
     restart: unless-stopped
     ports:
@@ -32,7 +40,8 @@ services:
       - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:-}
       - DEFAULT_MODELS=${DEFAULT_MODEL:-llama3.2:3b}
     depends_on:
-      - ollama
+      ollama:
+        condition: service_healthy
 
 volumes:
   ollama_data: