chore(scripts): embedding 服务改绑 0.0.0.0（主人口径），host 提成 EMBED_HOST

主人 2026-10-07：让服务监听 0.0.0.0。

- --host 由写死 127.0.0.1 改为可配置 EMBED_HOST，默认 0.0.0.0
- 实测结论登记进脚本注释：0.0.0.0 是 IPv4 通配、不覆盖 IPv6
  （netstat 只有 TCP 0.0.0.0:11434 LISTENING；http://[::1]:11434 仍失败）
  ⇒ 它修不了「客户端把 localhost 解析成 ::1 而卡住」那个故障；
  客户端侧仍必须用 127.0.0.1（见 internal/runtime/embedding）
- 同时登记暴露面事实：llama-server 没有鉴权，绑 0.0.0.0 等于让局域网内
  任何设备都能白嫖这台机器的 embedding 算力；设 EMBED_HOST=127.0.0.1
  即可收回（脚本已留这条退路）

scripts/embed.bat

@@ -34,6 +34,19 @@ set "SYS=%SystemRoot%\System32"
 if not defined LLAMA_DIR set "LLAMA_DIR=%USERPROFILE%\apps\llama.cpp"
 if not defined EMBED_MODEL set "EMBED_MODEL=%USERPROFILE%\.models\Qwen3-Embedding-0.6B-Q8_0.gguf"
 if not defined EMBED_PORT set "EMBED_PORT=11434"
+rem EMBED_HOST: which interface llama-server binds to.
+rem Default 0.0.0.0 = the owner's call (2026-10-07). TWO FACTS, both measured
+rem on this machine -- know them before changing this value back and forth:
+rem   1) llama-server has NO auth. Binding 0.0.0.0 exposes this machine's
+rem      embedding compute to EVERY device on the LAN. Set EMBED_HOST=127.0.0.1
+rem      to keep it local-only again.
+rem   2) 0.0.0.0 is an IPv4 wildcard and does NOT cover IPv6 -- MEASURED on
+rem      this machine (2026-10-07): with --host 0.0.0.0, netstat shows only
+rem      "TCP 0.0.0.0:11434 LISTENING" (no IPv6 entry) and http://[::1]:11434
+rem      still fails. So a client that resolves "localhost" to ::1 still
+rem      cannot reach it; clients must dial 127.0.0.1 (see
+rem      internal/runtime/embedding). Binding 0.0.0.0 does NOT fix that.
+if not defined EMBED_HOST set "EMBED_HOST=0.0.0.0"
 set "SERVER=%LLAMA_DIR%\llama-server.exe"
 set "LOG_FILE=%USERPROFILE%\llama.log"
 set "STDOUT_FILE=%USERPROFILE%\llama.stdout.log"
@@ -68,7 +81,7 @@ if not exist "%EMBED_MODEL%" (
   exit /b 1
 )
 echo Starting llama-server -^> %EMBED_MODEL%  ^(port %EMBED_PORT%^)
-powershell -NoProfile -Command "Start-Process -FilePath '%SERVER%' -ArgumentList '-m','%EMBED_MODEL%','--embeddings','--host','127.0.0.1','--port','%EMBED_PORT%','-c','4096','-b','2048','-ub','2048','-t','8' -WorkingDirectory '%LLAMA_DIR%' -RedirectStandardOutput '%STDOUT_FILE%' -RedirectStandardError '%LOG_FILE%' -WindowStyle Hidden"
+powershell -NoProfile -Command "Start-Process -FilePath '%SERVER%' -ArgumentList '-m','%EMBED_MODEL%','--embeddings','--host','%EMBED_HOST%','--port','%EMBED_PORT%','-c','4096','-b','2048','-ub','2048','-t','8' -WorkingDirectory '%LLAMA_DIR%' -RedirectStandardOutput '%STDOUT_FILE%' -RedirectStandardError '%LOG_FILE%' -WindowStyle Hidden"
 set /a TRIES=0
 :start_wait
 set /a TRIES+=1