honcho: enable OpenAI embeddings for conclusion vectorisation

- Add vault_honcho_openai_api_key (embeddings-only, Honcho-scoped)
- Inject OPENAI_API_KEY + LLM_OPENAI_API_KEY into api + deriver containers
- Flip honcho_embed_messages default to true now that embeddings have a provider
- Parameterise EMBEDDING__MODEL_CONFIG__{TRANSPORT,MODEL,BASE_URL} so we can
  later swap to a local OpenAI-compatible embedder (e.g. Ollama on
  astro-orbiter post-rebuild) with a single defaults change.

Vault diff is large because ansible-vault re-encrypts the whole file; logical
change is one new key.

ansible/roles/honcho/defaults/main.yml

@@ -111,7 +111,15 @@ honcho_deriver_flush_enabled: true
 #   3. Stand up a local BGE/nomic embedding endpoint (e.g. on astro-orbiter
 #      once GPU is ready) and point Honcho at it via
 #      EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL.
-honcho_embed_messages: false
+honcho_embed_messages: true
+
+# Embedding provider (transport must be openai-compatible). The default
+# OpenAI endpoint requires honcho_openai_api_key. To swap to a local
+# OpenAI-compatible embedder (e.g. Ollama), set honcho_embedding_base_url
+# to the upstream /v1 URL and the API key can be any non-empty string.
+honcho_embedding_transport: "openai"
+honcho_embedding_model: "text-embedding-3-small"
+honcho_embedding_base_url: ""
 
 # ---------------------------------------------------------------------------
 # Auth
@@ -126,9 +134,11 @@ honcho_auth_enabled: true
 # vault_honcho_database_password      - postgres role password
 # vault_honcho_jwt_secret             - 32+ byte random string for JWT signing
 # vault_honcho_anthropic_api_key      - Anthropic API key for Claude calls
+# vault_honcho_openai_api_key         - OpenAI API key, embeddings-only
 honcho_db_password: "{{ vault_honcho_database_password }}"
 honcho_jwt_secret: "{{ vault_honcho_jwt_secret }}"
 honcho_anthropic_api_key: "{{ vault_honcho_anthropic_api_key }}"
+honcho_openai_api_key: "{{ vault_honcho_openai_api_key }}"
 
 # ---------------------------------------------------------------------------
 # Health check