test(embeddings): cover custom embeddings authorization (#13763)

Merged. This is not covered by the existing `embeddings-auth.test.ts`, which asserts the *inbound* auth; yours records the *outbound* contract — the key configured on a custom OpenAI-compatible connection must leave as `Authorization: Bearer <key>`, with the mock returning 401 when it does not. That contract had no guard until now.

Validated as a combined board first (this PR merged with the 21 siblings of the same wave on the release tip): eslint with the frozen suppressions, typecheck:core, check:open-sse-typecheck, complexity, cognitive-complexity, changelog-integrity, i18n new-key coverage, docs-counts, docs-sync, migration-numbering, provider-consistency and a duplicate-identifier audit all green, plus 176 passing / 0 failing focused node:test cases across the 25 test files the wave touches and the dashboard test under Vitest (2/0). Then re-validated alone on the fresh tip before this merge: conflicts re-resolved, file sizes rebaselined for this PR's own growth, eslint and this PR's focused tests re-run.

Thank you.

tests/unit/issue-13234-embeddings-auth.test.ts

@@ -0,0 +1,66 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-issue-13234-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { createProviderNode } = await import("../../src/lib/db/providers/nodes.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const embeddingsRoute = await import("../../src/app/api/v1/embeddings/route.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+});
+
+test("custom OpenAI-compatible embeddings forward the configured bearer key", async () => {
+  const providerNode = await createProviderNode({
+    type: "openai-compatible",
+    name: "Custom embeddings provider",
+    prefix: "customembed13234",
+    apiType: "embeddings",
+    baseUrl: "https://embedding-provider.example/v1",
+  });
+
+  await providersDb.createProviderConnection({
+    provider: providerNode.id,
+    authType: "apikey",
+    name: "custom-embedding-key",
+    apiKey: "issue-13234-test-key",
+    testStatus: "active",
+    rateLimitedUntil: null,
+  });
+
+  const originalFetch = globalThis.fetch;
+  let capturedHeaders: Headers | null = null;
+  globalThis.fetch = async (_url: RequestInfo | URL, init: RequestInit = {}) => {
+    capturedHeaders = new Headers(init?.headers);
+    if (capturedHeaders.get("Authorization") !== "Bearer issue-13234-test-key") {
+      return Response.json({ error: { message: "authentication required" } }, { status: 401 });
+    }
+    return Response.json({
+      data: [{ object: "embedding", embedding: [0.1, 0.2], index: 0 }],
+      usage: { prompt_tokens: 1, total_tokens: 1 },
+    });
+  };
+
+  try {
+    const response = await embeddingsRoute.POST(
+      new Request("http://localhost/v1/embeddings", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ model: "customembed13234/test-model", input: "hello" }),
+      })
+    );
+    assert.equal(response.status, 200);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+
+  assert.ok(capturedHeaders, "the upstream request should be issued");
+  assert.equal(capturedHeaders.get("Authorization"), "Bearer issue-13234-test-key");
+});