fix: simplify ollama onboarding (#67005)

* feat(ollama): split interactive cloud and local setup

* test(ollama): cover cloud onboarding flow

* docs(ollama): simplify provider setup docs

* docs(onboarding): update ollama wizard copy

* fix(ollama): restore web search auth helper

* fix(ollama): harden setup auth and ssrf handling

* fix(ollama): address review regressions

* fix(ollama): scope ssrf hardening to ollama

* feat(ollama): add hybrid onboarding mode

* fix(ollama): tighten cloud credential setup

* refactor(ollama): distill host-backed setup modes

* fix(ollama): preserve cloud api key in config

* fix: simplify ollama onboarding (#67005)

docs/reference/wizard.md

@@ -40,7 +40,7 @@ For a high-level overview, see [Onboarding (CLI)](/start/wizard).
       - Sets `agents.defaults.model` to `openai/gpt-5.4` when model is unset, `openai/*`, or `openai-codex/*`.
     - **xAI (Grok) API key**: prompts for `XAI_API_KEY` and configures xAI as a model provider.
     - **OpenCode**: prompts for `OPENCODE_API_KEY` (or `OPENCODE_ZEN_API_KEY`, get it at https://opencode.ai/auth) and lets you pick the Zen or Go catalog.
-    - **Ollama**: prompts for the Ollama base URL, offers **Cloud + Local** or **Local** mode, discovers available models, and auto-pulls the selected local model when needed.
+    - **Ollama**: offers **Cloud + Local**, **Cloud only**, or **Local only** first. `Cloud only` prompts for `OLLAMA_API_KEY` and uses `https://ollama.com`; the host-backed modes prompt for the Ollama base URL, discover available models, and auto-pull the selected local model when needed; `Cloud + Local` also checks whether that Ollama host is signed in for cloud access.
     - More detail: [Ollama](/providers/ollama)
     - **API key**: stores the key for you.
     - **Vercel AI Gateway (multi-model proxy)**: prompts for `AI_GATEWAY_API_KEY`.