feat(ai): separate base URL and API key for chat vs embedding model

Per-workspace AI provider config previously shared a single base URL and
a single API key between the chat model and the embedding model. Add
dedicated, optional embedding endpoint/token that fall back to the chat
values when empty, preserving backward compatibility.

- db: new migration adds nullable `embedding_api_key_enc` to
  `ai_provider_credentials`; chat key stays in `api_key_enc`
- repo: add `upsertEmbeddingKey` / `clearEmbeddingKey` (on-conflict
  touches only its own column, so chat/embedding keys never overwrite)
- ai-settings.service: store non-secret `embeddingBaseUrl`; resolve()
  applies fallback (embeddingBaseUrl || baseUrl; embedding key || chat
  key); getMasked() exposes raw `embeddingBaseUrl` + `hasEmbeddingApiKey`,
  never the key; update() handles the embedding key write-only
- ai.service: getEmbeddingModel() builds openai/gemini/ollama with the
  embedding-specific URL/key; chat path unchanged
- client: new "Embedding base URL" and "Embedding API key" fields with
  fallback hints and a clear-key action

Requires running the DB migration on deploy.

apps/client/src/features/workspace/services/ai-settings-service.ts

@@ -4,31 +4,37 @@ import api from "@/lib/api-client";
 export type AiDriver = "openai" | "gemini" | "ollama";
 
 // Masked AI provider settings returned by the server.
-// The API key is NEVER returned; only `hasApiKey` indicates whether one is stored.
+// No API key is ever returned; only `hasApiKey` / `hasEmbeddingApiKey` indicate
+// whether one is stored. `embeddingBaseUrl` is the RAW stored value (empty means
+// "uses the chat base URL").
 export interface IAiSettings {
   driver?: AiDriver;
   chatModel?: string;
   embeddingModel?: string;
   baseUrl?: string;
+  embeddingBaseUrl?: string;
   systemPrompt?: string;
   hasApiKey: boolean;
+  hasEmbeddingApiKey: boolean;
   // RAG indexing coverage (pages indexed for semantic search).
   indexedPages: number;
   totalPages: number;
 }
 
-// Update payload. Key semantics:
-//   - omit `apiKey`        -> key unchanged
-//   - `apiKey: ''`         -> clear the stored key
-//   - `apiKey: 'non-empty'`-> set the key
+// Update payload. Key semantics (same for `apiKey` and `embeddingApiKey`):
+//   - omit the key         -> key unchanged
+//   - `key: ''`            -> clear the stored key
+//   - `key: 'non-empty'`   -> set the key
 // Non-secret fields are saved as given.
 export interface IAiSettingsUpdate {
   driver?: AiDriver;
   chatModel?: string;
   embeddingModel?: string;
   baseUrl?: string;
+  embeddingBaseUrl?: string;
   systemPrompt?: string;
   apiKey?: string;
+  embeddingApiKey?: string;
 }
 
 // Result of a connection test against the configured provider.