BYOK provider embeddings (wave 6 chunk B): kill local transformers

Replace the @huggingface/transformers local embedder (~316MB ONNX cache)
with an EmbeddingPort seam: graph.embeddingModel (nullable "provider:id"
slug) selects an OpenRouter/OpenAI/Gemini adapter, resolved fresh per
call from settings + the auth store so key rotations land immediately.

- src/server/embeddings.ts rewritten: slug grammar, injected-fetch
  adapters (OpenRouter input_type, Gemini taskType batching, OpenAI
  index-ordered rows), honest resolution (null = skip-with-info, set
  model with missing key = honest error), embedNewNodes with model-change
  re-embed wipe + ghost pruning + usage steps, federated catalog
  (OpenRouter /api/v1/embeddings/models — VERIFIED live, the inverse
  path 404s; OpenAI text-embedding- filter; Gemini embedContent filter).
- GET /api/models/embeddings: federated catalog, empty when no keys.
- Extraction tail records stages.embedding usage into the run's money
  channel; EMBEDDING_PRICES overlay in core/prices.ts (outside the
  sync-generated block), callCost falls back to it; cost-summary folds
  the fourth stage; graph-context injection resolves its embedder per
  run, fails honestly when unconfigured, records query tokens.
- Settings: GraphSettings.embeddingModel (null factory), section parser
  validates slug shape (id may contain colons — OpenRouter :free
  suffixes, live catalog fact).
- Removal: @huggingface/transformers uninstalled, PATHS.modelCache and
  onnx tracing entries deleted, @huggingface tracing-excludes guard
  added, stale sharp/libvips comments updated to historical.

Live-verified on port 3004: catalog federates 36 rows (33 OpenRouter +
3 OpenAI), embedNewNodes embedded 10 nodes via the free liquid/lfm-2.5
model (dim 1024, 435 prompt tokens, 1 call, $0), settings PUT rejects
bad slugs with 400.

Gates: typecheck, lint, 895/895 tests, build.

next.config.ts

@@ -12,7 +12,13 @@ const nextConfig: NextConfig = {
 	// INTO the standalone bundle. A shipped desktop app would carry the
 	// developer's session data inside it.
 	outputFileTracingExcludes: {
-		"*": ["data/**/*"],
+		"*": [
+			"data/**/*",
+			// Wave 6 (2026-09-23): the local transformers embeddings died — any
+			// @huggingface copy (or its ~300MB model cache, if one ever
+			// reappears) must never sweep into the standalone bundle again.
+			"node_modules/@huggingface/**/*",
+		],
 	},
 	// Empirically verified gaps (2026-09-17 standalone smoke): the tracer
 	// misses JSON loaded via `import ... with { type: "json" }` attributes —
@@ -31,21 +37,14 @@ const nextConfig: NextConfig = {
 			"node_modules/pdfjs-dist/standard_fonts/**/*",
 			"node_modules/@earendil-works/pi-ai/dist/providers/data/**/*",
 			"node_modules/@earendil-works/pi-agent-core/dist/**/*.json",
-			// onnxruntime-node: the .node binding was traced, but its
-			// sibling dylib (libonnxruntime.*.dylib, dlopen'd via @rpath)
-			// was not — dlopen fails at module load.
-			"node_modules/onnxruntime-node/bin/**/*",
 		],
 	},
 	// Framework-free core lives in src/ (plain TS, imported by routes and CLI alike).
 	// The pi engine must stay external: its providers are runtime-loaded Node
 	// code (undici streams, catalog data) that breaks when bundled into routes.
-	// transformers.js (embeddings) is runtime-loaded ONNX — same reason as
-	// the pi engine: bundling onnxruntime-node breaks route builds.
 	serverExternalPackages: [
 		"@earendil-works/pi-ai",
 		"@earendil-works/pi-agent-core",
-		"@huggingface/transformers",
 		"pdfjs-dist", // sources v0: bundling breaks its node fake-worker path
 	],
 };