albok-service: fold 0.1.9 (image pin, embedding_write on qwen3-embedding-bulk) from the live host

stacks/albok-service/README.md

@@ -8,7 +8,12 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
   (`servers/nh3-albok/README.md` says why and what must never be added there). Before that: nh3-docker, 2026-10-02 to 2026-10-04.
 - **URL:** `http://albok.nh3.internal:8392` (= `http://10.100.50.44:8392`). Container port 8390.
   Host port **8392** is kept from nh3-docker, where 8390 was the althing post office, so no client changed.
-- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.8` @ `sha256:239f900e…` (pinned in `compose.yaml`), built
+- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.9` @ `sha256:ba7b475b…` since 2026-10-05 0216, deployed by albok-dev on Prime's
+  authority, from vh/albok `382a962` (tag albok-service/v0.1.9). It adds `embedding_write`: writes (ingest, reindex) embed on
+  `qwen3-embedding-bulk` (nh3-ml1 first), queries stay on `qwen3-embedding` (esh-ml1 first), and a startup vector-space
+  check refuses writes, never reads, on a mismatch. Unchanged sections no longer count as updated. Rollback: the
+  `.pre-0.1.9` copies of compose.yaml and albok.yaml beside the live files, then `compose up -d`.
+  Prior: 0.1.8 @ `sha256:239f900e…` (pinned in `compose.yaml` until 10-05), built
   2026-10-04 ~1115 from vh/albok `e653c29` (tag albok-service/v0.1.8; heid re-pass fixes over 0.1.7: keyword-index
   lock mismatch, journal-stranding replay path, bypassable 400, link-kind handling in the collapse). fleet/memory
   reindexed on it per albok-dev (10,849 obj / 15,418 chunks, 1613.6 s, clean, commit 563dcae; their 0.1.7
@@ -59,7 +64,7 @@ inside the container and `chgrp`s wing dirs as uid 1500. Without the names in th
 Verified: wings came up `drwxr-s--- albok:albok-read` / `albok:albok-personal`, drift 0.
 
 **Secrets (vault):** `albok/litellm-key`, a LiteLLM key scoped to `qwen3-embedding` only (alias
-`albok-service`; verified 200 on embeddings, 403 on any other model); `albok/bootstrap-admin-token`,
+`albok-service`; verified 200 on embeddings, 403 on any other model; widened 2026-10-05 to also cover `qwen3-embedding-bulk`, the write-path alias, c0d3384); `albok/bootstrap-admin-token`,
 the first-start admin token (also at `/srv/albok/private/bootstrap-admin-token`, 0600).
 **Nemi (albok's tagger, runs on nh3-dev):** `albok/token-nemi`, a service token minted 0255 with read+write on
 `fleet/memory`, `fleet/stash` and `personal/agent-feedback`; it sees exactly those three wings (`personal/notes` hidden).