G2: embedd — text → vector via Ollama · 2 scrum fixes

Bridges the missing piece for the staffing co-pilot: text inputs to
vectord-shaped vectors. Standalone cmd/embedd on :3216 fronted by
gateway at /v1/embed. Pluggable embed.Provider interface (G2 ships
Ollama; OpenAI/Voyage swap in via the same interface in G3+).

Wire format:
  POST /v1/embed {"texts":[...], "model":"..."}  // model optional
  → 200 {"model","dimension","vectors":[[...]]}

Default model: nomic-embed-text (768-d). Ollama returns float64;
provider converts to float32 at the boundary so vectors flow through
vectord/HNSW without re-conversion.

Acceptance smoke 5/5 PASS — including the architectural payoff:
end-to-end embed → vectord add → search by re-embedded text returns
recall=1 at distance 5.96e-8 (float32 precision noise on identical
unit vectors). The staffing co-pilot pipeline (text → vector →
similarity search) is now functional end-to-end.

All 9 smokes (D1-D6 + G1 + G1P + G2) PASS deterministically.

Cross-lineage scrum on shipped code:
  - Opus 4.7 (opencode):                    0 BLOCK + 4 WARN + 3 INFO
  - Kimi K2-0905 (openrouter):              0 BLOCK + 2 WARN + 1 INFO
  - Qwen3-coder (openrouter):               "No BLOCKs" (3 tokens)

Fixed (2 — 1 convergent + 1 single-reviewer):
  C1 (Opus + Kimi convergent WARN): per-text 60s timeout × N-text
    batch was up to N×60s with no batch-level cap. One stuck Ollama
    call would stall the whole handler indefinitely. Fix:
    context.WithTimeout(r.Context(), 60s) wraps the entire batch.
  O-W3 (Opus WARN): empty strings in texts went to Ollama unchecked,
    producing version-dependent garbage. Fix: reject "" with 400 at
    the handler boundary so callers get a deterministic answer
    instead of an upstream-conditional 502.

Deferred (4): drainAndClose 64KiB cap (matches G0 pattern), no
concurrency limit on /embed (single-tenant G2), missing Accept
header (exotic-proxy concern), MaxBytesError string-match
redundancy (paranoia layer kept consistent across codebase).

Zero false positives this round — Qwen returned 3 tokens "No BLOCKs"
and the other two reviewers' findings were all real.

Setup confirmed: Ollama 0.21.0 on :11434 with nomic-embed-text loaded.
Per-text /api/embeddings used (forward-compat with 0.21+); newer
0.4+ /api/embed batch endpoint can swap in via the Provider interface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/shared/config.go

@@ -25,6 +25,7 @@ type Config struct {
 	Ingestd  IngestConfig  `toml:"ingestd"`
 	Queryd   QuerydConfig  `toml:"queryd"`
 	Vectord  VectordConfig `toml:"vectord"`
+	Embedd   EmbeddConfig  `toml:"embedd"`
 	S3       S3Config      `toml:"s3"`
 	Log      LogConfig     `toml:"log"`
 }
@@ -48,9 +49,9 @@ type IngestConfig struct {
 
 // GatewayConfig adds the upstream URLs the reverse proxy fronts.
 // Each route family (/v1/storage, /v1/catalog, /v1/ingest, /v1/sql,
-// /v1/vectors) has its own upstream so we can scale services
-// independently or move them to different boxes without touching
-// gateway code.
+// /v1/vectors, /v1/embed) has its own upstream so we can scale
+// services independently or move them to different boxes without
+// touching gateway code.
 type GatewayConfig struct {
 	Bind        string `toml:"bind"`
 	StoragedURL string `toml:"storaged_url"`
@@ -58,6 +59,17 @@ type GatewayConfig struct {
 	IngestdURL  string `toml:"ingestd_url"`
 	QuerydURL   string `toml:"queryd_url"`
 	VectordURL  string `toml:"vectord_url"`
+	EmbeddURL   string `toml:"embedd_url"`
+}
+
+// EmbeddConfig drives the embed service. ProviderURL points at the
+// embedding backend (Ollama in G2, possibly OpenAI/Voyage in G3+).
+// DefaultModel is what gets used when callers don't specify a
+// model in their request body.
+type EmbeddConfig struct {
+	Bind         string `toml:"bind"`
+	ProviderURL  string `toml:"provider_url"`
+	DefaultModel string `toml:"default_model"`
 }
 
 // VectordConfig adds vectord-specific knobs. StoragedURL is
@@ -123,6 +135,7 @@ func DefaultConfig() Config {
 			IngestdURL:  "http://127.0.0.1:3213",
 			QuerydURL:   "http://127.0.0.1:3214",
 			VectordURL:  "http://127.0.0.1:3215",
+			EmbeddURL:   "http://127.0.0.1:3216",
 		},
 		Storaged: ServiceConfig{Bind: "127.0.0.1:3211"},
 		Catalogd: CatalogConfig{Bind: "127.0.0.1:3212", StoragedURL: "http://127.0.0.1:3211"},
@@ -136,6 +149,11 @@ func DefaultConfig() Config {
 			Bind:        "127.0.0.1:3215",
 			StoragedURL: "http://127.0.0.1:3211",
 		},
+		Embedd: EmbeddConfig{
+			Bind:         "127.0.0.1:3216",
+			ProviderURL:  "http://localhost:11434", // local Ollama
+			DefaultModel: "nomic-embed-text",
+		},
 		Queryd: QuerydConfig{
 			Bind:         "127.0.0.1:3214",
 			CatalogdURL:  "http://127.0.0.1:3212",