feat: allow configuring the findings embeddings URL

[kmbroai]

Summary

The findings service always sent embedding requests to a fixed URL. Add CODEX_SECURITY_EMBEDDINGS_URL so CLI and standalone server deployments can use another compatible endpoint.

Changes

• Accept a full embeddings endpoint URL, preserving its path and query parameters. Unset or empty values retain https://api.openai.com/v1/embeddings.
• Pass the variable through Docker Compose and document it in CLI help, the environment reference, and .env.example.
• Cover custom endpoints through both server entrypoints using a local provider fixture; existing embedding tests cover the default endpoint and request contract.

Testing

• Focused embeddings, CLI server, and findings server tests: 31 passed.
• pnpm run types: passed.
• pnpm run format: passed.
• Docker Compose configuration check: preserves the complete configured URL.
• git diff --check: passed.
• Full local seeded suite: 2,117 passed, 41 skipped, one existing account test failed because an inherited API key took precedence over its synthetic ChatGPT login. Reran the credential suite without inherited API keys: all 6 passed.
• Hosted CI completed with 35 checks passed and 5 skipped on e184e348f9b13bf14150d8958f741bb7dfd16181, including Linux, macOS, Windows, container, and installed-package checks. Stopped the redundant local randomized run after hosted CI passed.
• Local full-suite checks used a private temporary directory outside the sandbox because sandbox ownership mapping caused existing trusted-path checks to fail.

Risk and rollout

This adds one optional public environment variable. Existing deployments keep the same endpoint, API-key precedence, bearer authentication, model, and dimensions. A configured endpoint receives the embedding inputs and API key and must implement the existing OpenAI embeddings contract. No database migration is needed.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.