LocalProvider remote fallback

Never automatically switch a failed local embedding provider to Voyage or OpenAI; remote embeddings require explicit search.embeddings.provider opt-in. Automatic fallback looks resilient but silently changes privacy, credential, cost, and provider boundaries. If the local model fails, keep remote calls at zero, emit the one-time informational notice, and degrade recall to FTS-only; related worker safety is in [[01a0a078-b779-72fc-8a9a-4c48ffb2cf62]].