security: fix critical auth gaps, SSRF, IDOR, and embedding error handling

CRITICAL:
- Add auth + admin check to 10 unprotected API routes (test-*, debug/*,
  config, models, fix-labels)
- Add CRON_SECRET bearer auth to /api/cron/reminders (was fully open)
- Add SSRF protection to getOllamaModels (blocks private/internal IPs)

HIGH:
- Fix getAllLabels() missing userId filter (leaked all users' labels)
- Fix /api/labels OR clause leaking other users' labels
- Fix IDOR in toggleAgent/getAgentActions (add ownership check)
- Fix getEmbeddings() returning [] on error in all 5 providers (corrupted
  semantic search with NaN cosine similarity) — now throws instead

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

memento-note/app/actions/notes.ts

@@ -1169,8 +1169,13 @@ export async function updateSize(id: string, size: 'small' | 'medium' | 'large')
 
 // Get all unique labels
 export async function getAllLabels() {
+  const session = await auth();
+  if (!session?.user?.id) return [];
   try {
-    const notes = await prisma.note.findMany({ select: { labels: true } })
+    const notes = await prisma.note.findMany({
+      where: { userId: session.user.id },
+      select: { labels: true }
+    })
     const labelsSet = new Set<string>()
     notes.forEach((note: any) => {
       const labels = note.labels ? JSON.parse(note.labels) : null