Run a Private Ollama API with Docker and Prove It Is Not Public

Deploy a pinned Ollama container with host-only and container-only access, then prove that LAN and internet paths stay closed.