fix(cli,test): keep cli.js under the size ceiling; make tests model-free

Two follow-ups to the five applied patches.

1. `feat(cli): bake network features in as defaults` added ten lines of
   flag plumbing to cli.js, which sat at exactly 400 — the ceiling. The
   dispatcher is the one file with no slack, since every new command adds
   a case, so the two flag helpers (parseOptionalInt, metricsOpts) and the
   per-host rate-limiter construction moved to src/cli/runtime.js. cli.js
   is back to 386 and stays a routing table; no behaviour change.

2. The test preload kept tests off the network but not off the model. A
   machine that has run `apple-docs sync` has the real 123 MB model.onnx
   in ~/.apple-docs/resources/models, and now that the pure-JS embedder
   actually works (patch 1), getEmbedder() parses the full fp32 matrix
   there instead of returning null. That makes local runs both slower and
   behaviourally different from CI, which has no corpus and therefore no
   model. The preload now points APPLE_DOCS_MODELS_DIR at a path that
   cannot exist, so getEmbedder() returns null everywhere; `??=` keeps an
   explicit override working for tests that want the real thing.

Suite: 2525 pass, 11 skip, 0 fail. Lint, typecheck, knip, size, audit all
clean.