feat(llm): recommend a verified no-tools reviewer model

[atomantic]

Summary

• add Gemma 3 27B IT as the featured recommendation for the read-only Security Scan
• keep the recommendation tied to the verified local Ollama build and document that runtime capability checks remain authoritative
• correct the GPT-OSS catalog tool capability and cover the Gemma 4 tool-capability distinction
• verify the catalog recommendation is highlighted in the model library

Validation

• cd server && npm test -- --run lib/localLlmCatalog.test.js
• cd client && npm test -- --run src/components/settings/LocalLlmTab.test.jsx
• cd client && npm run lint
• cd client && npm run build

Gemma 4 remains available in the general catalog, but is intentionally not eligible for this security preflight because its native function-calling capability violates the no-tools selection policy.