feat(db): inference guardrails — embedding cache + cost telemetry tables

0011: embedding_cache (content-addressed query embeddings),
inference_events (per-call token counts + estimated USD cost),
inference_spend_since() for one-round-trip budget checks,
touch_embedding_cache() for cache-hit bookkeeping.
orgs/org_members/projects references are to_regclass-guarded (same
pattern as 0008) so the file applies on a bare 0001..0010 database.
Gitignore allowlists the new file (migrations dir is ignore-all with
per-file allowlist; that pattern itself is audit #6 territory).