feat: add /v1/embeddings endpoint (OpenAI-compatible) (#146)

* feat: implement /v1/embeddings endpoint (#117)

Add OpenAI-compatible POST /v1/embeddings endpoint that routes through
the existing provider credential + fallback infrastructure.

Changes:
- open-sse/handlers/embeddingsCore.js: core handler (handleEmbeddingsCore)
  * Validates input (string or array), encoding_format
  * Builds provider-specific URL and headers for openai, openrouter,
    and openai-compatible providers
  * Handles 401/403 token refresh via executor.refreshCredentials
  * Returns normalized OpenAI-format response { object: 'list', data, model, usage }
- cloud/src/handlers/embeddings.js: cloud Worker handler (handleEmbeddings)
  * Auth + machineId resolution identical to handleChat
  * Provider credential fallback loop with rate-limit tracking
- cloud/src/index.js: wire new routes
  * POST /v1/embeddings  (new format — machineId from API key)
  * POST /{machineId}/v1/embeddings  (old format — machineId from URL)

* test: add unit tests for /v1/embeddings endpoint

- Setup vitest as test framework (tests/ directory)
- embeddingsCore.test.js (36 tests):
  - buildEmbeddingsBody: single string, array, encoding_format, default float
  - buildEmbeddingsUrl: openai, openrouter, openai-compatible-*, unsupported
  - buildEmbeddingsHeaders: per-provider headers, accessToken fallback
  - handleEmbeddingsCore: input validation, success path, provider errors,
    network errors, invalid JSON, token refresh 401 handling
- embeddings.cloud.test.js (23 tests):
  - CORS OPTIONS preflight
  - Auth: missing/invalid/old-format/wrong key → 401/400
  - Body validation: bad JSON, missing model, missing input, bad model → 400
  - Happy path: single string, array, delegation, CORS header, machineId override
  - Rate limiting: all-rate-limited → 429 + Retry-After, no credentials → 400
  - Error propagation: non-fallback errors, 429 exhausts accounts

Total: 59/59 tests passing
Framework: vitest v4.0.18, Node v22.22.0

* feat: add Next.js API route for /v1/embeddings endpoint

Wire the embeddings handler into Next.js App Router.

- src/app/api/v1/embeddings/route.js: Next.js API route (POST + OPTIONS)
- src/sse/handlers/embeddings.js: SSE-layer handler mirroring chat.js pattern

Uses handleEmbeddingsCore from open-sse/handlers/embeddingsCore.js with
the same auth, credential fallback, and token refresh logic as the chat
handler. Supports REQUIRE_API_KEY env var, provider fallback loop, and
consistent logging.

tests/README.md

@@ -0,0 +1,51 @@
+# 9Router Embeddings Tests
+
+Unit tests for the `/v1/embeddings` endpoint implementation.
+
+## Setup
+
+Vitest must be installed globally or in `/tmp/node_modules` (due to npm workspace hoisting from the root Next.js project):
+
+```bash
+cd /tmp && npm install vitest
+```
+
+## Running Tests
+
+```bash
+cd tests/
+NODE_PATH=/tmp/node_modules /tmp/node_modules/.bin/vitest run --reporter=verbose --config ./vitest.config.js
+```
+
+Or using the package script (from the `tests/` directory):
+
+```bash
+npm test
+```
+
+## Test Files
+
+| File | What it tests |
+|------|--------------|
+| `unit/embeddingsCore.test.js` | `open-sse/handlers/embeddingsCore.js` — core logic: body builder, URL router, headers, handler flow |
+| `unit/embeddings.cloud.test.js` | `cloud/src/handlers/embeddings.js` — cloud worker handler: auth, validation, rate limits, CORS |
+
+## Coverage Summary (59 tests)
+
+### `embeddingsCore.test.js` (36 tests)
+- `buildEmbeddingsBody`: single string, array, encoding_format, default float
+- `buildEmbeddingsUrl`: openai, openrouter, openai-compatible-*, unsupported providers
+- `buildEmbeddingsHeaders`: per-provider header sets, fallback to accessToken
+- `handleEmbeddingsCore` input validation: missing, wrong type, null, empty
+- `handleEmbeddingsCore` success: response format, CORS, Content-Type, callbacks
+- `handleEmbeddingsCore` errors: 400/429/500, network error, invalid JSON
+- `handleEmbeddingsCore` token refresh: 401 retry, graceful fallback
+
+### `embeddings.cloud.test.js` (23 tests)
+- CORS OPTIONS: 200 response, empty body, correct headers
+- Authentication: missing key, bad format, old-format key, wrong key value, valid key
+- Body validation: invalid JSON, missing model, missing input, bad model
+- Happy path: single string, array, correct delegation, CORS header, machineId override
+- Rate limiting: all accounts rate-limited → 503 + Retry-After, no credentials → 400
+- Error propagation: non-fallback errors passed through, 429 exhausts accounts
+- machineId override: validates key, rejects wrong key