security: fix critical auth gaps, SSRF, IDOR, and embedding error handling

CRITICAL:
- Add auth + admin check to 10 unprotected API routes (test-*, debug/*,
  config, models, fix-labels)
- Add CRON_SECRET bearer auth to /api/cron/reminders (was fully open)
- Add SSRF protection to getOllamaModels (blocks private/internal IPs)

HIGH:
- Fix getAllLabels() missing userId filter (leaked all users' labels)
- Fix /api/labels OR clause leaking other users' labels
- Fix IDOR in toggleAgent/getAgentActions (add ownership check)
- Fix getEmbeddings() returning [] on error in all 5 providers (corrupted
  semantic search with NaN cosine similarity) — now throws instead

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

memento-note/lib/ai/providers/custom-openai.ts

@@ -64,7 +64,7 @@ export class CustomOpenAIProvider implements AIProvider {
       return embedding;
     } catch (e) {
       console.error('Error generating embeddings (Custom OpenAI):', e);
-      return [];
+      throw e;
     }
   }
 

memento-note/lib/ai/providers/deepseek.ts

@@ -48,7 +48,7 @@ export class DeepSeekProvider implements AIProvider {
       return embedding;
     } catch (e) {
       console.error('Error generating embeddings (DeepSeek):', e);
-      return [];
+      throw e;
     }
   }
 

memento-note/lib/ai/providers/ollama.ts

@@ -105,7 +105,7 @@ Note content: "${content}"`;
       return data.embedding;
     } catch (e) {
       console.error('Error generating embeddings (Ollama):', e);
-      return [];
+      throw e;
     }
   }
 

memento-note/lib/ai/providers/openai.ts

@@ -48,7 +48,7 @@ export class OpenAIProvider implements AIProvider {
       return embedding;
     } catch (e) {
       console.error('Error generating embeddings (OpenAI):', e);
-      return [];
+      throw e;
     }
   }
 

memento-note/lib/ai/providers/openrouter.ts

@@ -48,7 +48,7 @@ export class OpenRouterProvider implements AIProvider {
       return embedding;
     } catch (e) {
       console.error('Error generating embeddings (OpenRouter):', e);
-      return [];
+      throw e;
     }
   }