security: fix critical auth gaps, SSRF, IDOR, and embedding error handling

CRITICAL:
- Add auth + admin check to 10 unprotected API routes (test-*, debug/*,
  config, models, fix-labels)
- Add CRON_SECRET bearer auth to /api/cron/reminders (was fully open)
- Add SSRF protection to getOllamaModels (blocks private/internal IPs)

HIGH:
- Fix getAllLabels() missing userId filter (leaked all users' labels)
- Fix /api/labels OR clause leaking other users' labels
- Fix IDOR in toggleAgent/getAgentActions (add ownership check)
- Fix getEmbeddings() returning [] on error in all 5 providers (corrupted
  semantic search with NaN cosine similarity) — now throws instead

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

memento-note/app/api/debug/config/route.ts

@@ -1,11 +1,20 @@
 import { NextResponse } from 'next/server';
 import { getSystemConfig } from '@/lib/config';
+import { auth } from '@/auth';
 
 /**
  * Debug endpoint to check AI configuration
  * This helps verify that OpenAI is properly configured
  */
 export async function GET() {
+  const session = await auth()
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+  if ((session.user as any).role !== 'ADMIN') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
   try {
     const config = await getSystemConfig();
 

memento-note/app/api/debug/test-chat/route.ts

@@ -1,7 +1,16 @@
 import { NextResponse } from 'next/server';
 import { chatService } from '@/lib/ai/services/chat.service';
+import { auth } from '@/auth';
 
 export async function POST(req: Request) {
+  const session = await auth()
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+  if ((session.user as any).role !== 'ADMIN') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
   try {
     const body = await req.json();
     console.log("TEST ROUTE INCOMING BODY:", body);