feat(m14): AI assistant — explain diagnostics, opt-in (Ollama or Claude) — 0.27.0

New optional module (D24): explains the collected findings in plain language,
contacted ONLY on an explicit user action (never automatic).

- core/ai.py: provider chosen explicitly (no default) — ollama (local) or claude
  (Anthropic Messages API via stdlib urllib; key in keyring). Grounded prompt;
  HTTP error parsing; one-shot (no thinking/caching — snappy).
- core/ai_knowledge.py: curated reference KB (Xid/SMART/Proton/tunables),
  exact keyword/code match ("RAG-lite", no embeddings) injected into the prompt —
  lifts local models, sharpens Claude. No fine-tuning.
- config: ai_provider/ai_model/ai_endpoint + keyring-backed AI key (generalized
  the token keyring helpers).
- GUI: Settings → AI assistant (provider radios, model/endpoint/key, Save/Test);
  "Explain with AI" button on the diagnostic dialog (consent prompt for cloud).
- CLI: `rigdoctor ai status|test|explain`.
- Docs: D24, SPEC/MODULES/ROADMAP (Phase 7); tests for providers/grounding/parse.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/SPEC.md

@@ -152,6 +152,16 @@ type too (e.g. a sudo password, which stays local and is never sent to B). Accou
 Gitea token; per-session share code. The shared terminal preserves colors/theming and can be
 viewed full-screen. *(The earlier read-only stats view / bundle export were dropped — D23.)*
 
+### M14 — AI assistant (D24)
+Optional module that explains the collected diagnostics in plain language. **Strictly opt-in and
+never automatic** — the model is contacted only when the user presses "Explain with AI" (GUI) or
+runs `rigdoctor ai explain`; configuring it contacts nothing. The user explicitly chooses a
+provider (no default): **Ollama** (local, private, no key) or **Claude** (Anthropic Messages
+API, key in the keyring, with a consent prompt before sending data). Answers are **grounded** in
+the actual findings plus matched reference facts from a curated, exact-match knowledge base
+("RAG-lite" — no embeddings/vector store, stdlib only); no fine-tuning. HTTP via stdlib `urllib`
+(no new core dependency); output is advisory (consistent with D9).
+
 ## 5. Non-functional requirements
 - **Zero hard deps for the core/CLI/daemon** — Python stdlib + tools already present. **Qt
   (PySide6) is required only by the GUI (M10) and tray (M11) modules**, declared in the