[ci skip] Add Ollama TCP entrypoint for HA voice pipeline

Expose Ollama at 10.0.20.202:11434 via Traefik TCP passthrough,
bypassing TLS/auth issues with the HTTPS ingress.

modules/kubernetes/traefik/main.tf

@@ -109,6 +109,12 @@ resource "helm_release" "traefik" {
         protocol    = "TCP"
         expose      = { default = true }
       }
+      ollama-tcp = {
+        port        = 11434
+        exposedPort = 11434
+        protocol    = "TCP"
+        expose      = { default = true }
+      }
     }
 
     service = {

modules/kubernetes/whisper/main.tf

@@ -231,3 +231,26 @@ resource "kubernetes_manifest" "piper_tcp_ingressroute" {
     }
   }
 }
+
+# TCP passthrough from Traefik to ollama service (for HA voice pipeline)
+resource "kubernetes_manifest" "ollama_tcp_ingressroute" {
+  manifest = {
+    apiVersion = "traefik.io/v1alpha1"
+    kind       = "IngressRouteTCP"
+    metadata = {
+      name      = "ollama-tcp"
+      namespace = "traefik"
+    }
+    spec = {
+      entryPoints = ["ollama-tcp"]
+      routes = [{
+        match = "HostSNI(`*`)"
+        services = [{
+          name      = "ollama"
+          namespace = "ollama"
+          port      = 11434
+        }]
+      }]
+    }
+  }
+}