BYOK provider embeddings (wave 6 chunk B): kill local transformers

Replace the @huggingface/transformers local embedder (~316MB ONNX cache)
with an EmbeddingPort seam: graph.embeddingModel (nullable "provider:id"
slug) selects an OpenRouter/OpenAI/Gemini adapter, resolved fresh per
call from settings + the auth store so key rotations land immediately.

- src/server/embeddings.ts rewritten: slug grammar, injected-fetch
  adapters (OpenRouter input_type, Gemini taskType batching, OpenAI
  index-ordered rows), honest resolution (null = skip-with-info, set
  model with missing key = honest error), embedNewNodes with model-change
  re-embed wipe + ghost pruning + usage steps, federated catalog
  (OpenRouter /api/v1/embeddings/models — VERIFIED live, the inverse
  path 404s; OpenAI text-embedding- filter; Gemini embedContent filter).
- GET /api/models/embeddings: federated catalog, empty when no keys.
- Extraction tail records stages.embedding usage into the run's money
  channel; EMBEDDING_PRICES overlay in core/prices.ts (outside the
  sync-generated block), callCost falls back to it; cost-summary folds
  the fourth stage; graph-context injection resolves its embedder per
  run, fails honestly when unconfigured, records query tokens.
- Settings: GraphSettings.embeddingModel (null factory), section parser
  validates slug shape (id may contain colons — OpenRouter :free
  suffixes, live catalog fact).
- Removal: @huggingface/transformers uninstalled, PATHS.modelCache and
  onnx tracing entries deleted, @huggingface tracing-excludes guard
  added, stale sharp/libvips comments updated to historical.

Live-verified on port 3004: catalog federates 36 rows (33 OpenRouter +
3 OpenAI), embedNewNodes embedded 10 nodes via the free liquid/lfm-2.5
model (dim 1024, 435 prompt tokens, 1 call, $0), settings PUT rejects
bad slugs with 400.

Gates: typecheck, lint, 895/895 tests, build.

tests/settings-body.test.ts

@@ -156,6 +156,30 @@ describe("parseGraphSettingsBody", () => {
 		const r = parseGraphSettingsBody({ enabled: false, clustering: true, labeling: true });
 		assert.ok(r.ok);
 	});
+
+	it("embeddingModel (wave 6): null or a shipped-provider slug; anything else is a 400", () => {
+		const nulled = parseGraphSettingsBody({ embeddingModel: null });
+		assert.ok(nulled.ok);
+		assert.deepEqual(nulled.settings, { embeddingModel: null });
+		for (const slug of [
+			"openai:text-embedding-3-small",
+			"openrouter:openai/text-embedding-3-large",
+			"google:gemini-embedding-001",
+			// OpenRouter ids may carry a :free-style suffix — the provider is
+			// the part before the FIRST colon (live catalog fact, 2026-09-23).
+			"openrouter:liquid/lfm-2.5-embedding-350m:free",
+		]) {
+			const r = parseGraphSettingsBody({ embeddingModel: slug });
+			assert.ok(r.ok, slug);
+			assert.deepEqual(r.settings, { embeddingModel: slug });
+		}
+		// Bad shapes never become a live model.
+		assert.equal(parseGraphSettingsBody({ embeddingModel: "text-embedding-3-small" }).ok, false, "no provider prefix");
+		assert.equal(parseGraphSettingsBody({ embeddingModel: "bedrock:whatever" }).ok, false, "unshipped provider");
+		assert.equal(parseGraphSettingsBody({ embeddingModel: "openai:" }).ok, false, "empty id");
+		assert.equal(parseGraphSettingsBody({ embeddingModel: 42 }).ok, false, "non-string");
+		assert.equal(parseGraphSettingsBody({ embeddingModel: "openai:has spaces" }).ok, false, "whitespace id");
+	});
 });
 
 describe("SETTINGS_SECTIONS (the route's section map)", () => {