security: fix critical auth gaps, SSRF, IDOR, and embedding error handling

CRITICAL:
- Add auth + admin check to 10 unprotected API routes (test-*, debug/*,
  config, models, fix-labels)
- Add CRON_SECRET bearer auth to /api/cron/reminders (was fully open)
- Add SSRF protection to getOllamaModels (blocks private/internal IPs)

HIGH:
- Fix getAllLabels() missing userId filter (leaked all users' labels)
- Fix /api/labels OR clause leaking other users' labels
- Fix IDOR in toggleAgent/getAgentActions (add ownership check)
- Fix getEmbeddings() returning [] on error in all 5 providers (corrupted
  semantic search with NaN cosine similarity) — now throws instead

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

memento-note/app/actions/agent-actions.ts

@@ -246,6 +246,13 @@ export async function getAgentActions(agentId: string) {
   }
 
   try {
+    // Verify the agent belongs to the user
+    const agent = await prisma.agent.findFirst({
+      where: { id: agentId, userId: session.user.id },
+      select: { id: true }
+    })
+    if (!agent) throw new Error('Agent non trouve')
+
     const actions = await prisma.agentAction.findMany({
       where: { agentId },
       orderBy: { createdAt: 'desc' },
@@ -276,7 +283,7 @@ export async function toggleAgent(id: string, isEnabled: boolean) {
 
   try {
     const agent = await prisma.agent.update({
-      where: { id },
+      where: { id, userId: session.user.id },
       data: { isEnabled }
     })
     return { success: true, agent }