GAT-00001: Add /v1/embeddings endpoint

[andrei-hasna]

Summary

• Add OpenAI-compatible POST /v1/embeddings handling through gateway auth, routing, provider fallback, budgets, usage normalization, and ledger recording.
• Make routing operation-aware so chat still requires chat/streaming/tools capabilities while embeddings require embeddings capability.
• Add OpenAI-compatible provider /embeddings request building and embeddings-specific usage serialization.

Validation

• bun install
• bun test (64 pass)
• bun run typecheck
• bun run build
• staged secrets scan over git diff --cached --no-ext-diff found no credential-shaped matches before commit

Adversarial Review

• Checked that chat routing remains the default for existing resolveRoute(options, request) callers.
• Changed new provider adapter methods to optional to avoid breaking external TypeScript adapters; gateway fails closed if an embeddings model is configured for an adapter without embed support.
• Verified embedding request input is not written to the usage ledger and postflight hard-budget failures still record spend before rejecting.

Task: 4cf413d2-fd1e-4882-9659-a2514392169d

[andrei-hasna]

OpenLoops worker update for task 738dfa4a-e136-469f-861d-afe21f16ab2b.

Code blocker found by adversarial review was fixed and pushed as de7ce10 (fix: redact MCP route explanation output). Changed files: src/mcp/index.ts, tests/mcp.test.ts.

Validation passed locally on the fixed PR head and again on a no-commit merge of the fixed PR into current origin/main (2fab81cf9bc9b5bc6aed3408933db6f82e5fdc30):

• bun test tests/mcp.test.ts: 6 pass, 0 fail
• bun run typecheck: pass
• bun test: 64 pass, 0 fail
• bun run build: pass
• staged/pre-push scans: no high-confidence credential/private-key matches; broad hits were only deliberate redaction-test placeholders.

Current GitHub PR state after push: OPEN, non-draft, mergeable=MERGEABLE, mergeStateStatus=CLEAN, headRefOid=de7ce10ddaa1c5d760be7f60916a87bfc9388a71, no status checks reported, reviewDecision empty.

Merge is currently blocked on formal non-author review/access. Current gh auth is andrei-hasna, which is the PR author. The selected non-author reviewer from task routing is kriptoburak, but GitHub rejected the REST reviewer request with HTTP 422 because reviews may only be requested from collaborators and kriptoburak is not a collaborator on hasna/gateway. Follow-up todos task cce45f04 records the access gate.