RAG: /embed endpoint on the LLM service (Bedrock-backed)

[qiuethan]

Sub-issue of the RAG retrieval epic (#125). Stage 1 of 3: embed.

Scope

• Add an /embed endpoint to the LLM service returning vectors for one or more input strings.
• Bedrock-backed, mirroring the existing provider abstraction (LLM service: provider abstraction + Claude implementation #42) rather than introducing a second pattern.
• Reuse the service's API-key auth for internal callers (LLM service: API-key auth for internal callers #41).
• Batch input; surface the model identifier and dimensionality in the response so the store can validate what it is persisting.

Acceptance

• An internal caller with a valid key gets deterministic-length vectors for a batch of strings.
• Provider errors surface as typed failures, not 500s.
• The embedding model is configurable, not hardcoded at the call site.