BYOK provider embeddings (wave 6 chunk B): kill local transformers

Replace the @huggingface/transformers local embedder (~316MB ONNX cache)
with an EmbeddingPort seam: graph.embeddingModel (nullable "provider:id"
slug) selects an OpenRouter/OpenAI/Gemini adapter, resolved fresh per
call from settings + the auth store so key rotations land immediately.

- src/server/embeddings.ts rewritten: slug grammar, injected-fetch
  adapters (OpenRouter input_type, Gemini taskType batching, OpenAI
  index-ordered rows), honest resolution (null = skip-with-info, set
  model with missing key = honest error), embedNewNodes with model-change
  re-embed wipe + ghost pruning + usage steps, federated catalog
  (OpenRouter /api/v1/embeddings/models — VERIFIED live, the inverse
  path 404s; OpenAI text-embedding- filter; Gemini embedContent filter).
- GET /api/models/embeddings: federated catalog, empty when no keys.
- Extraction tail records stages.embedding usage into the run's money
  channel; EMBEDDING_PRICES overlay in core/prices.ts (outside the
  sync-generated block), callCost falls back to it; cost-summary folds
  the fourth stage; graph-context injection resolves its embedder per
  run, fails honestly when unconfigured, records query tokens.
- Settings: GraphSettings.embeddingModel (null factory), section parser
  validates slug shape (id may contain colons — OpenRouter :free
  suffixes, live catalog fact).
- Removal: @huggingface/transformers uninstalled, PATHS.modelCache and
  onnx tracing entries deleted, @huggingface tracing-excludes guard
  added, stale sharp/libvips comments updated to historical.

Live-verified on port 3004: catalog federates 36 rows (33 OpenRouter +
3 OpenAI), embedNewNodes embedded 10 nodes via the free liquid/lfm-2.5
model (dim 1024, 435 prompt tokens, 1 call, $0), settings PUT rejects
bad slugs with 400.

Gates: typecheck, lint, 895/895 tests, build.

src/core/ports.ts

@@ -243,3 +243,49 @@ export interface AuthStore {
 	/** Remove one VAR if present (absent = no-op, still a silent success). */
 	deleteAuthVar(name: string): void;
 }
+
+// ─── EmbeddingPort — BYOK provider embeddings (wave 6, 2026-09-23) ───────────
+
+/**
+ * The provider-embedding seam (the local transformers embedder died with
+ * this wave): vectors come from the user's keyed provider — OpenRouter,
+ * OpenAI, or Google — named by graph.embeddingModel ("provider:id", null =
+ * honestly off: embedding/clustering/injection skip with an info log).
+ *
+ * Owner decisions (2026-09-23) baked in:
+ *  - The adapters are resolved FRESH per call from the setting + the auth
+ *    store (key rotations land immediately — the search port's treatment).
+ *  - Vectors are stored as the provider returns them (default dims, no
+ *    truncation, no normalization); the ledger is self-describing on
+ *    model + dim, and any model change voids it (full re-embed).
+ *  - Usage (prompt tokens) flows back to the money channel: adapters
+ *    report it, the caller records it as a CallUsage step.
+ *
+ * Pure types only (browser-safe): the adapters are server-side
+ * (src/server/embeddings.ts) and arrive as injected dependencies.
+ */
+
+/** Which side of retrieval the text is — providers bill identically but
+ *  quality-optimize differently (OpenRouter's input_type, Gemini's
+ *  taskType); every input in one call shares the task. */
+export type EmbeddingTask = "document" | "query";
+
+/** One embedding batch's result: vectors in input order, the model's
+ *  identity + dim (the ledger stamps), and the provider-reported prompt
+ *  token count (undefined = provider didn't report; cost stays honest
+ *  "—" via the existing unpriced path). */
+export interface EmbeddingResult {
+	vectors: number[][];
+	/** The full "provider:id" slug — ledger/cost keys use it verbatim. */
+	model: string;
+	dim: number;
+	promptTokens?: number;
+}
+
+/** A live provider embedding adapter. `embed` throws on failure (adapters
+ *  map HTTP errors to clear Error messages); callers treat failure as
+ *  non-fatal per the extraction contract. */
+export interface EmbeddingPort {
+	model: string;
+	embed(texts: readonly string[], task: EmbeddingTask): Promise<EmbeddingResult>;
+}