feat: add /v1/embeddings endpoint (OpenAI-compatible) (#146)

* feat: implement /v1/embeddings endpoint (#117)

Add OpenAI-compatible POST /v1/embeddings endpoint that routes through
the existing provider credential + fallback infrastructure.

Changes:
- open-sse/handlers/embeddingsCore.js: core handler (handleEmbeddingsCore)
  * Validates input (string or array), encoding_format
  * Builds provider-specific URL and headers for openai, openrouter,
    and openai-compatible providers
  * Handles 401/403 token refresh via executor.refreshCredentials
  * Returns normalized OpenAI-format response { object: 'list', data, model, usage }
- cloud/src/handlers/embeddings.js: cloud Worker handler (handleEmbeddings)
  * Auth + machineId resolution identical to handleChat
  * Provider credential fallback loop with rate-limit tracking
- cloud/src/index.js: wire new routes
  * POST /v1/embeddings  (new format — machineId from API key)
  * POST /{machineId}/v1/embeddings  (old format — machineId from URL)

* test: add unit tests for /v1/embeddings endpoint

- Setup vitest as test framework (tests/ directory)
- embeddingsCore.test.js (36 tests):
  - buildEmbeddingsBody: single string, array, encoding_format, default float
  - buildEmbeddingsUrl: openai, openrouter, openai-compatible-*, unsupported
  - buildEmbeddingsHeaders: per-provider headers, accessToken fallback
  - handleEmbeddingsCore: input validation, success path, provider errors,
    network errors, invalid JSON, token refresh 401 handling
- embeddings.cloud.test.js (23 tests):
  - CORS OPTIONS preflight
  - Auth: missing/invalid/old-format/wrong key → 401/400
  - Body validation: bad JSON, missing model, missing input, bad model → 400
  - Happy path: single string, array, delegation, CORS header, machineId override
  - Rate limiting: all-rate-limited → 429 + Retry-After, no credentials → 400
  - Error propagation: non-fallback errors, 429 exhausts accounts

Total: 59/59 tests passing
Framework: vitest v4.0.18, Node v22.22.0

* feat: add Next.js API route for /v1/embeddings endpoint

Wire the embeddings handler into Next.js App Router.

- src/app/api/v1/embeddings/route.js: Next.js API route (POST + OPTIONS)
- src/sse/handlers/embeddings.js: SSE-layer handler mirroring chat.js pattern

Uses handleEmbeddingsCore from open-sse/handlers/embeddingsCore.js with
the same auth, credential fallback, and token refresh logic as the chat
handler. Supports REQUIRE_API_KEY env var, provider fallback loop, and
consistent logging.

cloud/src/index.js

@@ -12,6 +12,7 @@ import { handleVerify } from "./handlers/verify.js";
 import { handleTestClaude } from "./handlers/testClaude.js";
 import { handleForward } from "./handlers/forward.js";
 import { handleForwardRaw } from "./handlers/forwardRaw.js";
+import { handleEmbeddings } from "./handlers/embeddings.js";
 import { createLandingPageResponse } from "./services/landingPage.js";
 
 // Initialize translators at module load (static imports)
@@ -115,6 +116,13 @@ const worker = {
         return addCorsHeaders(response);
       }
 
+      // New format: /v1/embeddings
+      if (path === "/v1/embeddings" && request.method === "POST") {
+        const response = await handleEmbeddings(request, env, ctx, null);
+        log.response(response.status, Date.now() - startTime);
+        return addCorsHeaders(response);
+      }
+
       // New format: /v1/responses (OpenAI Responses API - Codex CLI)
       if (path === "/v1/responses" && request.method === "POST") {
         const response = await handleChat(request, env, ctx, null);
@@ -149,6 +157,14 @@ const worker = {
         return response;
       }
 
+      // Machine ID based embeddings endpoint
+      if (path.match(/^\/[^\/]+\/v1\/embeddings$/) && request.method === "POST") {
+        const machineId = path.split("/")[1];
+        const response = await handleEmbeddings(request, env, ctx, machineId);
+        log.response(response.status, Date.now() - startTime);
+        return addCorsHeaders(response);
+      }
+
       // Machine ID based messages endpoint (Claude format)
       if (path.match(/^\/[^\/]+\/v1\/messages$/) && request.method === "POST") {
         const machineId = path.split("/")[1];