feat(m14): AI assistant — explain diagnostics, opt-in (Ollama or Claude) — 0.27.0

New optional module (D24): explains the collected findings in plain language,
contacted ONLY on an explicit user action (never automatic).

- core/ai.py: provider chosen explicitly (no default) — ollama (local) or claude
  (Anthropic Messages API via stdlib urllib; key in keyring). Grounded prompt;
  HTTP error parsing; one-shot (no thinking/caching — snappy).
- core/ai_knowledge.py: curated reference KB (Xid/SMART/Proton/tunables),
  exact keyword/code match ("RAG-lite", no embeddings) injected into the prompt —
  lifts local models, sharpens Claude. No fine-tuning.
- config: ai_provider/ai_model/ai_endpoint + keyring-backed AI key (generalized
  the token keyring helpers).
- GUI: Settings → AI assistant (provider radios, model/endpoint/key, Save/Test);
  "Explain with AI" button on the diagnostic dialog (consent prompt for cloud).
- CLI: `rigdoctor ai status|test|explain`.
- Docs: D24, SPEC/MODULES/ROADMAP (Phase 7); tests for providers/grounding/parse.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/DECISIONS.md

@@ -249,9 +249,24 @@ duplicated what the GUI already shows and added surface area. Concretely:
   (preserves fish/ls/git theming), full-screen-able, with the guest read-only unless the host
   ticks "Allow the guest to type" (the D9 consent exception). Account-gated by the Gitea token.
 
+### D24 — AI assistant module (M14) — *DECIDED 2026-05-22; adds to D14*
+A new optional module that **explains the collected diagnostics in plain language** (likely
+root cause + suggested next steps). Adds M14 to the D14 set.
+- **Strictly opt-in, never automatic.** The model is contacted **only** on an explicit user
+  action (an "Explain with AI" button / `rigdoctor ai explain`) — never on launch, after a
+  diagnostic, in the sample/record loop, or in the background. **Configuring** a provider does
+  not trigger any call.
+- **Local-first.** Defaults to a local **Ollama** server (data never leaves the machine, no
+  key, stdlib `urllib`). An **OpenAI-compatible** endpoint (cloud or local) can be used with a
+  key (stored in the keyring like the update token). Cloud use shows a "this sends your data to
+  X" consent before the first call.
+- **Grounded & advisory.** The prompt carries only the findings we collected; output is framed
+  as suggestions (consistent with D9 — it explains/recommends, applying fixes stays
+  consent-gated). No new runtime dependency (HTTP via stdlib).
+
 ## Open
 
-None currently — all tracked decisions (D1–D23) are resolved. New questions will be added
+None currently — all tracked decisions (D1–D24) are resolved. New questions will be added
 here as they arise. Remaining detail to flesh out during build: the tray's supporting-action
 set (D13), per-module apt package names, M12's tunnel/token specifics, and M13's
 update mechanism (APT repo vs. self-installed `.deb`).