feat(embedding): query/document prefixes for OpenAI-compatible embedders

[seathatflowsinourveins]

What changed

Adds two optional config keys, embedding_query_prefix and
embedding_document_prefix (env: AI_MEMORY_EMBEDDING_QUERY_PREFIX /
AI_MEMORY_EMBEDDING_DOCUMENT_PREFIX), applied by the openai and
openai-compat embedders. Each is prepended to the text before the
existing truncation. Both default to empty (no behaviour change when
unset) and are never trimmed: a publisher's trailing space (e.g.
"query: ") is part of the instruction, and an env var explicitly set to
"" clears a config.toml value rather than being treated as unset.
OpenAiEmbedder/OpenAiCompatEmbedder gained a with_prefixes builder
and now override embed_query/embed_document; embed is unchanged.

Also fixes memory_query's internal embed_query helper
(ai-memory-mcp/src/server.rs): it called the generic Embedder::embed
instead of Embedder::embed_query, so a query/document-asymmetric
embedder (Google's task-typed embeddings, or a configured query prefix)
embedded search queries on the document side.

A third change folds a non-empty embedding_document_prefix into the
stored embedding identity (Embedder::model_identity(), default
model().to_string() — every other provider is unaffected), via a
versioned SHA-256 fingerprint ("+dp1-" + first 16 hex chars, not a
32-bit hash, to avoid collisions between different prefixes). A document
prefix change makes retrieval, backfill, and cleanup treat existing pages
as stale and re-embed them automatically; an empty prefix keeps the exact
pre-existing identity, so upgrading installs need no migration. Real
surface area across 8 production Rust files for a feature whose
alternative is a documented ai-memory embed --force, so it is its own
commit (3rd) on a complete 2nd commit — verified to drop cleanly.

Both wrapper scripts forward the two new env vars on presence rather than
non-emptiness, so a present-but-empty override reaches the container and
clears a TOML-configured prefix (bin/ai-memory.ps1 notes that an
operator's own $env:NAME = '' additionally needs PowerShell 7.5+ for
that to leave a set-but-empty variable rather than deleting it; not
exercised on a real pwsh runtime). Docs updated:
docs/llm-providers.md, docs/install.md, docs/ARCHITECTURE.md.

Why

Asymmetric embedding models use a different instruction for the query
side than for the indexed-document side. The OpenAI-compatible
/v1/embeddings wire format has no field for it, so the client has to
add it. nvidia/Nemotron-3-Embed-1B-BF16 and base E5 models specify a
simple "query: " / "passage: " pair. Instruction-tuned E5 variants and
Qwen3-Embedding instead need a task-instruction string on the query side
only, with a publisher-specific trailing-space convention that differs
between the two (intfloat/e5-mistral-7b-instruct:
"Instruct: {task}\nQuery: "; Qwen3-Embedding:
"Instruct: {task}\nQuery:"). Without this, an operator running any of
these through openai-compat got degraded retrieval with no config-level
fix; only google had built-in query/document asymmetry.

Test plan

• cargo fmt --all -- --check and git diff --check pass
• cargo clippy --workspace --all-targets -- -D warnings passes, 0
  warnings
• cargo test --workspace --all-targets --no-fail-fast: 3546 passed,
  3 failed, 14 ignored. The 3 failures also fail, with identical
  names and root causes, on unmodified main, unrelated to
  embeddings.
• On a v2.4.0 + this patch build: ai-memory-llm 270 passed/0
  failed, ai-memory-mcp 465 passed/0 failed — identical to the
  feature branch.
• Unit, wiremock and loader tests cover: prefix applied per side, unset is
  a true no-op, model_identity behaves correctly per provider, the
  fingerprint does not collide on a pair that collided under an earlier
  32-bit-hash design, Config::load through a TOML file in an isolated
  child process with both prefix env vars removed, memory_query calling
  embed_query not embed, and fake-Docker wrapper argument capture
  across unset/empty/whitespace-only/non-empty.
• ai-memory-consolidate's embed_backfill.rs suite is extended with two
  tests: a document-prefix change makes backfill treat a page as stale
  and re-embed it; a forced rebuild with one page failing mid-run still
  purges both pages and leaves the failed page with no row.

Commit attribution

• Verify the name/email on every commit before requesting merge (see
  CONTRIBUTING.md).

Release impact

• Minor — additive: two new config keys / env vars, no default
  changed. The 3rd commit changes what gets stored only for a
  non-default (non-empty document-prefix) configuration.

CHANGELOG (merge gate)

• CHANGELOG.md [Unreleased] → ### Added entry for the new keys
  (including the identity-folding behaviour) and a ### Fixed entry
  for the embed→embed_query bug.

Notes for reviewers

The 3rd commit is the one design decision worth an explicit call — see
"What changed" above; it's kept separate specifically so it can be
reviewed and dropped on its own.

🤖 Generated with Claude Code