feat(TRUEREF-0007): implement pluggable embedding generation and vector storage

Add EmbeddingProvider interface with OpenAI-compatible, local (optional
@xenova/transformers via dynamic import), and Noop (FTS5-only fallback)
implementations. EmbeddingService batches requests and persists Float32Array
blobs to snippet_embeddings. GET/PUT /api/v1/settings/embedding endpoints
read and write embedding config from the settings table.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/api/v1/settings/embedding/+server.ts

@@ -0,0 +1,147 @@
+/**
+ * GET  /api/v1/settings/embedding — retrieve current embedding configuration
+ * PUT  /api/v1/settings/embedding — update embedding configuration
+ */
+
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { getClient } from '$lib/server/db/client';
+import {
+	EMBEDDING_CONFIG_KEY,
+	createProviderFromConfig,
+	defaultEmbeddingConfig,
+	type EmbeddingConfig
+} from '$lib/server/embeddings/factory';
+import { handleServiceError, InvalidInputError } from '$lib/server/utils/validation';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function readConfig(db: ReturnType<typeof getClient>): EmbeddingConfig {
+	const row = db
+		.prepare(`SELECT value FROM settings WHERE key = ?`)
+		.get(EMBEDDING_CONFIG_KEY) as { value: string } | undefined;
+
+	if (!row) return defaultEmbeddingConfig();
+
+	try {
+		return JSON.parse(row.value) as EmbeddingConfig;
+	} catch {
+		return defaultEmbeddingConfig();
+	}
+}
+
+function validateConfig(body: unknown): EmbeddingConfig {
+	if (typeof body !== 'object' || body === null) {
+		throw new InvalidInputError('Request body must be a JSON object');
+	}
+
+	const obj = body as Record<string, unknown>;
+
+	const provider = obj.provider;
+	if (provider !== 'openai' && provider !== 'local' && provider !== 'none') {
+		throw new InvalidInputError(
+			`Invalid provider "${String(provider)}". Must be one of: openai, local, none.`
+		);
+	}
+
+	if (provider === 'openai') {
+		const openai = obj.openai as Record<string, unknown> | undefined;
+		if (!openai || typeof openai !== 'object') {
+			throw new InvalidInputError('openai config object is required when provider is "openai"');
+		}
+		if (typeof openai.baseUrl !== 'string' || !openai.baseUrl) {
+			throw new InvalidInputError('openai.baseUrl must be a non-empty string');
+		}
+		if (typeof openai.apiKey !== 'string' || !openai.apiKey) {
+			throw new InvalidInputError('openai.apiKey must be a non-empty string');
+		}
+		if (typeof openai.model !== 'string' || !openai.model) {
+			throw new InvalidInputError('openai.model must be a non-empty string');
+		}
+
+		const config: EmbeddingConfig = {
+			provider: 'openai',
+			openai: {
+				baseUrl: openai.baseUrl as string,
+				apiKey: openai.apiKey as string,
+				model: openai.model as string,
+				dimensions:
+					typeof openai.dimensions === 'number' ? (openai.dimensions as number) : undefined,
+				maxBatchSize:
+					typeof openai.maxBatchSize === 'number'
+						? (openai.maxBatchSize as number)
+						: undefined
+			}
+		};
+		return config;
+	}
+
+	return { provider: provider as 'local' | 'none' };
+}
+
+// ---------------------------------------------------------------------------
+// GET
+// ---------------------------------------------------------------------------
+
+export const GET: RequestHandler = () => {
+	try {
+		const db = getClient();
+		const config = readConfig(db);
+
+		// Strip the apiKey from the response for security.
+		const safeConfig = sanitizeForResponse(config);
+		return json(safeConfig);
+	} catch (err) {
+		return handleServiceError(err);
+	}
+};
+
+// ---------------------------------------------------------------------------
+// PUT
+// ---------------------------------------------------------------------------
+
+export const PUT: RequestHandler = async ({ request }) => {
+	try {
+		const body = await request.json();
+		const config = validateConfig(body);
+
+		// Verify provider connectivity before persisting (skip for noop).
+		if (config.provider !== 'none') {
+			const provider = createProviderFromConfig(config);
+			const available = await provider.isAvailable();
+			if (!available) {
+				throw new InvalidInputError(
+					`Could not connect to the "${config.provider}" embedding provider. Check your configuration.`
+				);
+			}
+		}
+
+		const db = getClient();
+		db.prepare(
+			`INSERT INTO settings (key, value, updated_at)
+			 VALUES (?, ?, unixepoch())
+			 ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`
+		).run(EMBEDDING_CONFIG_KEY, JSON.stringify(config));
+
+		const safeConfig = sanitizeForResponse(config);
+		return json(safeConfig);
+	} catch (err) {
+		return handleServiceError(err);
+	}
+};
+
+// ---------------------------------------------------------------------------
+// Sanitize — remove sensitive fields before returning to clients
+// ---------------------------------------------------------------------------
+
+function sanitizeForResponse(config: EmbeddingConfig): Omit<EmbeddingConfig, 'openai'> & {
+	openai?: Omit<NonNullable<EmbeddingConfig['openai']>, 'apiKey'>;
+} {
+	if (config.provider === 'openai' && config.openai) {
+		const { apiKey: _apiKey, ...rest } = config.openai;
+		return { ...config, openai: rest };
+	}
+	return config;
+}