feat(rag)!: drop the deployment embedding key; add data-protection docs - #1604

What this delivers

Two things, both for #1596 (Refs — whether the issue closes on them or waits for the deployment-specific evidence is your call).

1. docs/data-protection.md — the data-protection pack a DPO or security officer reads against a running deployment. It leads with the posture that matters for NFA-024/025: nothing leaves by default. Every external hop is a row or a setting somebody adds — a model profile, a parser choice, a search method, a Logfire token, a mem0 host, an MCP connection — and a deployment that wants no third party configures local chat models (ollama, litellm, or any base_url provider behind a gateway), pymupdf or a LiteParse sidecar for parsing, no Logfire token, and no search/memory/MCP bindings. The one exception is named: the embedding catalog holds OpenRouter and OpenAI only, so a knowledge base always reaches one of them. Nothing on the page claims GDPR compliance; what only a deployment can decide is listed as evidence to obtain.

2. Embeddings are paid for with the collection's vault key, and nothing else (breaking). OPENROUTER_API_KEY was a deployment-wide fallback for one provider, left over from when openrouter.ai was hardcoded — and the only reason the catalog carried a deployment_key flag, the resolver two fallback states and a cross-provider rule, the embedding-models route a default_provider, and the create form a "Deployment key" row that applied to one provider and not the other. Every collection now names its provider from embedding_providers.json and the organization vault key that pays, the way a chat model is keyed per organization.

What changed

Docs

• docs/data-protection.md — new: responsibilities; every store holding personal data, in the database and outside it (Redis rate-limit keys with the plain address, Prefect parameters carrying an event-triggered run's event_context, Logfire, SMTP, backups); every destination and the setting that decides it; a controls matrix mapping each control to its proof or its open issue; what deletion reaches and leaves; the evidence a deployment has to obtain; a reproducible verification checklist (doctor, vault-rotate --dry-run, an env sweep that masks keys, SQL over profiles / plain-HTTP endpoints / secrets / collections / connections / environment Logfire tokens, and an orphaned-attachment check comparing stored paths with the disk); the open conditions for a first rollout.
• mkdocs.yml, docs/rollout.md (security-review table row), SECURITY.md, CLAUDE.md topic map, scripts/docs_drift.py triggers.
• docs/configuration.md, docs/file-processing.md, docs/howto/set-up-knowledge-base.md, backend/.env.example, CHANGELOG.md — the embedding key contract.

Backend

• config.py — OPENROUTER_API_KEY removed.
• embedding_providers.json / embedding_providers.py — no deployment_key, no deployment_provider(); require() takes a provider id.
• embedding_resolution.py — EmbeddingKeySource is ORGANIZATION | NONE_CHOSEN | SECRET_MISSING | SECRET_UNUSABLE | SECRET_WRONG_KIND; every non-organization source resolves to an empty key and is announced in the flow log. A provider the catalog no longer names keeps its key to itself.
• embeddings.py — no default key or endpoint; a service built outside any collection refuses on first use with a message that names no variable.
• knowledge_base.py — a new personal/org collection must name embedding_provider and embedding_secret_id (refused on the field otherwise); app-scoped collections have no vault and stay keyless; clear_embedding_secret removed from the update path, schema and repository; the legacy POST /rag/collections/{name} row records the first catalog provider and waits for a key via PATCH /kb/{id}.
• GET /rag/embedding-models — no default_provider, no deployment_key.

Frontend

• embedding-picker.tsx — no "Deployment key" row; the key select is empty ("Choose a key") until one is chosen, controlled with "" so switching provider really empties it.
• create-kb-dialog.tsx — preselects the first catalogued provider, always sends provider and key, shows the server's field refusal under the picker.
• embedding-dialog.tsx — a key is replaced, never cleared.
• types/knowledge-base.ts, messages/en.json (chooseKey added; deploymentKey, keyHereBillsEmbeddings removed; keyRequiredHere, modelsUnreadable reworded).

Noticed, not fixed

• No code path removes a chat attachment's bytes. chat_files rows cascade with their message but nothing unlinks the file under MEDIA_DIR; the one caller of FileUploadService.discard is the channel router. Deleting a conversation or an account leaves attachments on disk. Belongs to Erasure and export of one person's data: what UserService.delete leaves behind #1421.
• A deleted account keeps its memory. agent_memory_files.owner_key is a string, not a foreign key, and UserService.delete never calls MemoryService.forget_person. Also Erasure and export of one person's data: what UserService.delete leaves behind #1421.
• frontend/src/app/api/auth/password/change/route.ts sets the refreshed cookies' secure from NODE_ENV instead of secureCookies(request) as login/refresh do. One-line fix; kept out of this PR.
• No self-hosted embedding provider in the catalog, so a fully on-premises deployment cannot use the knowledge base. Not tracked yet; worth its own issue if the city needs RAG without an external embedder.

Testing

• make test against a real Postgres (docker db + redis from the repo's compose): 7539 passed, integration suite included, 100% coverage on the platform layer.
• make test-frontend-cov: 417 files / 6145 tests, 100% lines-statements-functions, 97.71% branches (floor 97.5).
• ruff, ty, vulture, deptry; tsc, eslint, prettier, check:i18n, knip — clean.
• make docs-build (--strict), paragraph/backtick guards, codespell — clean; every page.md#fragment on the new page checked against the target's headings by script.
• Codex security review: 15 threads, each verified against the code, fixed in the page and resolved.

Breaking

OPENROUTER_API_KEY is no longer read. A collection created without a vault key refuses to embed until PATCH /kb/{id} gives it one; clear_embedding_secret is gone from KnowledgeBaseUpdate; default_provider and deployment_key are gone from GET /rag/embedding-models. No migration: knowledge_bases.embedding_secret_id stays nullable for app-scoped rows.