fix(ci): allow card-embed.js and skip pgvector on non-superuser CI

Add lib/card-embed.js to the server-only LLM allowlist (forbidden-patterns
Check 3). Make the pgvector migration degrade gracefully when CT 102 CI
cannot CREATE EXTENSION vector so migrate up still passes.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/ci.yml

@@ -196,6 +196,7 @@ jobs:
           fi
           SERVER_ONLY=(
             lib/scan-vision.js
+            lib/card-embed.js
           )
           LLM_PATTERN='generativelanguage\.googleapis\.com|api\.openai\.com|ai-gateway\.vercel\.sh'
           LLM_FOUND=()

migrations/1782000000001_add-card-embeddings.js

@@ -1,6 +1,11 @@
 /**
  * pgvector + cards.embedding for Layer-0 visual catalog search.
  *
+ * Neon prod: CREATE EXTENSION vector succeeds for the project owner.
+ * Homelab CI (`deckhearth_ci`, non-superuser): extension create may fail;
+ * we skip embedding DDL so migrate still passes — L0 escalates until
+ * an operator enables pgvector on CT 102 or runs backfill on Neon.
+ *
  * @type {import('node-pg-migrate').ColumnDefinitions | undefined}
  */
 export const shorthands = undefined;
@@ -13,7 +18,24 @@ const EMBED_DIMENSION = 1024;
  */
 export const up = (pgm) => {
   pgm.sql(`
-    CREATE EXTENSION IF NOT EXISTS vector;
+    DO $do$
+    BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
+        CREATE EXTENSION vector;
+      END IF;
+    EXCEPTION
+      WHEN insufficient_privilege OR OTHERS THEN
+        RAISE NOTICE 'vector extension unavailable on this database (%). Skipping embedding DDL.', SQLERRM;
+        RETURN;
+    END
+    $do$;
+
+    DO $do$
+    BEGIN
+      IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
+        RAISE NOTICE 'vector extension not installed — skipping cards.embedding columns';
+        RETURN;
+      END IF;
 
       ALTER TABLE cards
         ADD COLUMN IF NOT EXISTS embedding vector(${EMBED_DIMENSION}),
@@ -22,6 +44,8 @@ export const up = (pgm) => {
       CREATE INDEX IF NOT EXISTS idx_cards_embedding_hnsw
         ON cards USING hnsw (embedding vector_cosine_ops)
         WHERE embedding IS NOT NULL;
+    END
+    $do$;
   `);
 };