feat: Ollama vision OCR via Windows PC for label photo matching

- Add persistent SSH tunnel (systemd service) to Windows PC Ollama
- Add _HAS_OLLAMA check at server startup (qwen2.5vl:3b)
- Replace Tesseract-only OCR with Ollama-first strategy
- Ollama (qwen2.5vl:3b) handles dark/complex labels Tesseract can't read
- Keurig serial 2500.0100.0025534 now correctly matched as Asset #5144
- Add ocr_source field to /api/ocr response ('ollama' or 'tesseract')
- Fix match_label_photo.py argparse bug (image_paths -> images)
- Update match_label_photo.py CLI to read vision key from Hermes config

scripts/match_label_photo.py

@@ -163,7 +163,7 @@ def main():
         _process_text(text, db_path)
         return
 
-    for img_path in args.image_paths:
+    for img_path in args.images:
         if not Path(img_path).exists():
             print(f"\n=== SKIP: {img_path} (not found) ===")
             continue