feat(learn): metered embeddings and the cache (decision-engine 6.2)

plane/models/openrouter-embedding.yaml: openai/text-embedding-3-small via
OpenRouter (embeddings only), input_per_m 0.02, cache/output 0, egress
openrouter.ai; `openrouter` joins the provider extensions.

plane/budget.py MeteredEmbeddingClient: prompt_tokens priced from the
Model manifest, usd/calls ceilings stop the next call, a priced call that
reports no tokens raises UnmeteredUsage (a silent zero is an instrument
failure). OpenRouterEmbeddingClient keeps one usage row per call
(parse_embedding_payload); its api key is out of repr.

learn/embeddings.py + `ousast learn memory embed`: excerpts embedded in
batches into embeddings/<model-slug>/<excerpt_sha>.json (float32 base64),
cached by content hash so a rerun makes no call; the declared dimension is
checked; --dry-run estimates tokens and cost without a call; a paid run
needs --budget-usd and exits 3 (unfinished) at its ceiling. Not run against
the provider: the store embedding waits for its budget go-ahead.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

plane/models/openrouter-embedding.yaml

@@ -0,0 +1,24 @@
+# The embedding model of the decision engine's local memory (learned-decision-engine design 4.1-4.2, Req 3.2).
+# OpenRouter serves embeddings only; the chat model stays DeepSeek. `openrouter` is not an ax provider, so the
+# annotation declares the extension. `secretKey` names the Kubernetes Secret and key that hold OPENROUTER_API_KEY;
+# the key itself is never in a manifest. Prices in USD per million tokens: embeddings bill input only, so the cache
+# and output rates are 0 and `plane.budget.MeteredEmbeddingClient` prices the provider's `usage.prompt_tokens`.
+apiVersion: ax.io/v1alpha1
+kind: Model
+metadata:
+  name: openrouter-embedding
+  atespace: default   # ax's own name for the namespace field (plane/manifests.py)
+  annotations:
+    openultrasast.io/provider-extension: "true"
+    openultrasast.io/egress-hosts: "openrouter.ai"   # provider.openrouter base URL; the embed task's only model egress
+spec:
+  provider: openrouter
+  model: openai/text-embedding-3-small
+  secretKey:
+    name: openrouter
+    key: OPENROUTER_API_KEY
+  parameters:
+    cache_hit_per_m: 0
+    input_per_m: 0.02
+    output_per_m: 0
+    dimensions: 1536