feat(embeddings): record the embedding contract and refuse a mismatched config (#189)

Stored vectors are only searchable with the backend, model, width and
prefixes that built them, and nothing enforced that: changing [embedding]
(or backend) without reembed_embeddings silently broke similarity search,
and the per-row dim check missed same-width model or prefix swaps.

- embedding_contract: one row (backend, model, dim, both prefixes). The
  server checks it once after migrations; the src/bin tools check it on
  their first embed. No row yet = record the running config.
- On a mismatch every embed (embed_many, so queries and documents) fails
  with a message naming each changed field and the fix. Mixing vector
  spaces corrupts the corpus for good; refusing only pauses semantic
  search until the config is put back or the corpus re-embedded.
- reembed_embeddings bypasses the guard and records the contract after a
  full run (all four tables, no --limit, not --dry-run).
- A DB error in the check leaves embedding allowed and is logged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -1004,7 +1004,10 @@ tests never touch the process environment. ADR-0003 records the split.
 Sections: `backend`, `unified_search_model`, `[llamacpp]` (`url`, `chat`, `vision`,
 `timeout_secs`, `[llamacpp.picker]` `include`/`exclude`), `[ollama]`,
 `[openrouter]`, `[embedding]` (`model`, `dim`, `query_prefix`, `document_prefix` —
-the corpus contract: change any and run `reembed_embeddings`), `[tts]`
+the corpus contract: change any and run `reembed_embeddings`; `src/ai/embedding_contract.rs`
+stores it in `embedding_contract` on first start and refuses every embed, with a startup
+error naming the changed fields, once the config no longer matches; a full
+`reembed_embeddings` run records the new one), `[tts]`
 (`model`, `voice`, `ref_seconds`, `timeout_secs`), `[agentic]` (`max_iterations`,
 `chat_max_iterations`, `chat_default_num_ctx`, `chat_turn_timeout_secs`).