fix(embeddings): send explicit User-Agent on cloud HTTP requests

[kivo360]

Summary

OpenAIEmbeddingProvider and MiniMaxEmbeddingProvider build their HTTP request through stdlib urllib, which sends the default Python-urllib/3.x User-Agent. Cloudflare-fronted gateways (notably Fireworks, a popular OpenAI-compatible backend) reject that signature with HTTP 403 / error 1010 ("browser signature banned"), surfacing as:

RuntimeError: OpenAI API HTTP 403: error code: 1010

…from _call_api, which makes embed_graph(provider=\"openai\") unusable against Fireworks out of the box even though the README explicitly lists "Qwen/Qwen3-Embedding-8B" (a Fireworks-hosted model) as a recommended choice.

This PR adds a single module-level _USER_AGENT constant and sends it (plus an explicit Accept: application/json) from both providers.

Changes

• code_review_graph/embeddings.py: new _USER_AGENT = \"code-review-graph/<version> (+<repo URL>)\", threaded into both providers' headers.
• tests/test_embeddings.py: two new assertions — MiniMaxEmbeddingProvider.test_embed_sends_user_agent_header and an addition to the existing OpenAIEmbeddingProvider.test_embed_calls_api_with_correct_payload — verifying the header is present on outgoing requests.

No public API change. Strict superset of existing behavior.

Reproducer

export CRG_OPENAI_API_KEY=fw_...
export CRG_OPENAI_BASE_URL=https://api.fireworks.ai/inference/v1
export CRG_OPENAI_MODEL=accounts/fireworks/models/qwen3-embedding-8b
export CRG_ACCEPT_CLOUD_EMBEDDINGS=1

# Before this PR:
python -c \"from code_review_graph.embeddings import get_provider; \
           get_provider('openai').embed_query('hi')\"
# RuntimeError: OpenAI API HTTP 403: error code: 1010

# After this PR:
# returns a 4096-dim vector

End-to-end: against a real omoi_os graph (11,572 nodes), `embed_graph(provider='openai')` against Fireworks Qwen3-Embedding-8B completes in ~3m45s after the fix; before the fix it errors on the first batch.

Test plan

• uv run ruff check code_review_graph/embeddings.py tests/test_embeddings.py — clean
• uv run pytest tests/test_embeddings.py -q — 85 passed (was 83, +2 new)
• Live embed_graph smoke against Fireworks qwen3-embedding-8b — succeeds, returns 4096-dim vectors

Notes

• I deliberately kept the UA narrow ("code-review-graph/ (+repo URL)") rather than impersonating a browser — gives upstream gateways a clean way to identify CRG traffic in their logs and reduces the chance of being clumped with bot fingerprints.
• The same fix is plausibly relevant to any future provider that uses raw urllib (e.g. if a generic Cohere/Voyage provider is added later). Worth considering a tiny _call_with_user_agent(req) helper if more providers land.