deploy-vllm: add embedding-mode support, cut over Hindsight to vLLM (t_e6facb19)

- vllm.service.j2: branch on role==embedding for --runner pooling
  --convert embed, --no-enable-prefix-caching, per-model
  trust_remote_code toggle (needed for nomic-embed-text-v1.5's custom
  NomicBertModel code), and enforce_eager toggle (needed to avoid CUDA
  graph capture OOM when co-resident with another vLLM process on this
  24GB card).
- tasks/verify.yml: split completions vs embedding smoke tests --
  embedding-mode instances don't serve /v1/completions. Assert a
  non-empty embedding vector, not just HTTP 200.
- host_vars/astro-orbiter: enable nomic-embed-text-v1.5 (port 8020),
  lower primary model's gpu_memory_utilization 0.95->0.90 + add
  enforce_eager after finding 0.95 crash-looped 6-7x before stabilizing
  with co-resident nomic-embed (real fix, confirmed via NRestarts=0
  after clean stop/start, not luck).
- Hindsight (values.yaml + externalsecret.yaml): cut LLM + embeddings
  over to vLLM (:8000, :8020), wire the previously-unset
  HINDSIGHT_API_EMBEDDINGS_* env vars for the first time, and swap the
  API key secret source from the Nous fallback item to vllm/api-key
  (vLLM enforces real auth, llama-swap did not).
- README: document the embedding-mode branch, VRAM findings, and a
  genuine architecture gap -- vLLM's one-model-per-process design
  cannot replace llama-swap's 5-model LRU roster on this 24GB card, so
  21 Hermes profiles' aux-model consumers (Qwen3-8B-no_think,
  Phi-3.5-mini, Meta-Llama-3.1-8B, Qwen2.5-Coder-14B) and OpenViking's
  VLM stay on llama-swap. Full teardown (t_6dff1ecc) needs a human
  decision on the aux-model strategy before it can proceed.

cluster/applications/hindsight/externalsecret.yaml

@@ -55,6 +55,15 @@ spec:
         # env-var-named keys injected via envFrom
         HINDSIGHT_API_MCP_AUTH_TOKEN: "{{ .HINDSIGHT_API_MCP_AUTH_TOKEN }}"
         HINDSIGHT_API_LLM_API_KEY: "{{ .HINDSIGHT_API_LLM_API_KEY }}"
+        # Cutover to vLLM (t_e6facb19, 2026-08-31): vLLM enforces its API key
+        # on every request (unlike llama-swap, which accepted any/no key) —
+        # confirmed empirically, a bad/missing key gets a real 401
+        # {"error":"Unauthorized"}. Both the completions endpoint (:8000) and
+        # the embeddings endpoint (:8020) are separate vLLM processes but
+        # share the SAME key (api-key.env is written once, read by both
+        # systemd units per roles/deploy-vllm/tasks/api-key.yml). Reuse
+        # HINDSIGHT_API_LLM_API_KEY's value for the embeddings key too.
+        HINDSIGHT_API_EMBEDDINGS_OPENAI_API_KEY: "{{ .HINDSIGHT_API_LLM_API_KEY }}"
   data:
     # 1Password item "hindsight", field "postgres-password".
     # letters+digits only / URL-safe: required because the chart interpolates the
@@ -69,11 +78,15 @@ spec:
       remoteRef:
         key: hindsight
         property: HINDSIGHT_API_MCP_AUTH_TOKEN
-    # 1Password item "nous" (vault mk-labs), field "api-key" (Ryan-provisioned,
-    # decision 4). Replaces the prior "local-placeholder" value — astro-orbiter
-    # did not validate; now wired to the Nous free-tier inference API. Materialized
-    # Secret key name stays HINDSIGHT_API_LLM_API_KEY (env-var-named, envFrom).
+    # Cutover to vLLM (t_e6facb19, 2026-08-31): astro-orbiter's llama-swap
+    # (which needed no real auth) is being retired for Hindsight's
+    # completions+embeddings roles. vLLM enforces a real API key — read the
+    # SAME key roles/deploy-vllm's api-key.yml phase writes to
+    # /etc/vllm/api-key.env on astro-orbiter, sourced from 1Password
+    # op://mk-labs/vllm/api-key (item "vllm", field "api-key", vault mk-labs).
+    # Replaces the prior "nous" item's api-key (Nous free-tier fallback,
+    # no longer the active LLM backend once this cutover lands).
     - secretKey: HINDSIGHT_API_LLM_API_KEY
       remoteRef:
-        key: nous
+        key: vllm
         property: api-key