feat: Phase 2 — embeddings + hybrid memory.search

Adds a small embedder sidecar (Xenova/bge-small-en-v1.5, ONNX, CPU-only)
that the web app calls inline on memory.write and memory.update, and on
demand from the new memory.search tool.

memory.search performs three candidate fetches in parallel — pgvector
cosine similarity, Postgres full-text via plainto_tsquery + ts_rank_cd,
and tag-set overlap — then fuses them with Reciprocal Rank Fusion
(k=60). Each result carries its per-source rank so the model can see
*why* a memory surfaced.

The migrator boot step gained an idempotent embedding backfill: any row
with embedding IS NULL is batched (32 at a time) through the embedder
after SQL migrations apply. Safe to run on every boot.

New tool memory.update fixes the missing edit path; centralises the
re-embed-on-content-change rule alongside write.

Stack additions:
- apps/embedder/ — Fastify server, persistent /data/models volume so the
  ~30 MB model only downloads once
- apps/web/lib/embedder.ts — typed HTTP client with batched embed +
  health probe
- packages/schemas — MemoryUpdateInput, MemorySearchInput
- docker-compose — embedder service, healthcheck, app + migrator both
  depend_on it healthy; EMBEDDER_URL promoted to a required env var

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/lib/env.ts

@@ -21,9 +21,8 @@ const envSchema = z.object({
   // Database
   DATABASE_URL: z.string().url(),
 
-  // Embedder (used in Phase 2; present-but-empty allowed in Phase 1)
-  EMBEDDER_URL: z
-    .preprocess((v) => (v === "" ? undefined : v), z.string().url().optional()),
+  // Embedder sidecar — required in Phase 2 since memory.write embeds inline.
+  EMBEDDER_URL: z.string().url(),
   EMBEDDING_MODEL: z.string().default("Xenova/bge-small-en-v1.5"),
   EMBEDDING_DIM: z.coerce.number().int().positive().default(384),
 
@@ -72,7 +71,7 @@ function buildPhaseStub(): Env {
     OIDC_CLIENT_ID_MCP: "build",
     OIDC_AUDIENCE: "build",
     DATABASE_URL: "postgres://build:build@build-phase.invalid:5432/build",
-    EMBEDDER_URL: undefined,
+    EMBEDDER_URL: "http://embedder.invalid:8080",
     EMBEDDING_MODEL: "Xenova/bge-small-en-v1.5",
     EMBEDDING_DIM: 384,
     NEXTAUTH_SECRET: "build-phase-secret-not-used-at-runtime-xxxxxxxx",