[Enh]: Embedding Phase 3: Parameter Substitution

## What

Add `auto-embed` to stored procedure parameter configuration.

When enabled, DAB accepts a string value from the caller, sends that value to the configured embedding subsystem, receives a stringified embedding, then passes that string to the stored procedure parameter.

This removes the burden of real-time embedding from the app and database. The database still owns vector conversion, vector validation, and semantic search behavior.

## Why

Stored procedures often encapsulate search logic. When a stored procedure needs a vector, the caller or database currently has to create the embedding.

`auto-embed` moves that step into DAB.

The API contract stays simple:

```text
client sends text
DAB embeds text
stored procedure receives embedding string
database handles the rest
```

## Dependency

This feature depends on the runtime embedding subsystem introduced by PR #3104.

Assume that subsystem is merged before implementation begins.

`auto-embed` consumes the embedding subsystem. It doesn't define a provider contract, embedding endpoint, health model, retry model, or embedding response shape.

The embedding subsystem provides:

```text
runtime.embeddings configuration
internal embedding service
single text embedding support
batch text embedding support
embedding timeout handling
embedding telemetry
embedding validation through RuntimeConfigValidator
```

Implementation rule:

```text
If runtime.embeddings is valid, auto-embed can use it.
If runtime.embeddings is invalid, DAB validation or startup fails before auto-embed runs.
```

## Non-goals

This feature doesn't add semantic search to DAB.

This feature doesn't add native vector type support.

This feature doesn't validate vectors in DAB.

This feature doesn't support client-provided vectors.

This feature doesn't support table or view fields.

This feature doesn't support arrays or objects.

This feature doesn't change normal stored procedure parameter behavior.

This feature doesn't add a new embedding health check.

This feature doesn't add a new embedding timeout setting.

This feature doesn't add a new embedding concurrency setting.

## Configuration

`auto-embed` is a child property of a stored procedure parameter object.

The current schema already models stored procedure parameters as an array of named parameter objects. `name` is already required.

Example:

```json
{
"entities": {
"SearchProducts": {
"source": {
"object": "dbo.SearchProducts",
"type": "stored-procedure",
"parameters": [
{
"name": "searchText",
"required": true,
"auto-embed": true,
"description": "Text to embed before procedure execution."
}
]
},
"permissions": [
{
"role": "anonymous",
"actions": [
"execute"
]
}
]
}
}
}
```

`auto-embed` defaults to `false`.

Allowed values use the existing DAB boolean pattern:

```json
{
"name": "searchText",
"auto-embed": true
}
```

```json
{
"name": "searchText",
"auto-embed": false
}
```

```json
{
"name": "searchText",
"auto-embed": "@env('AUTO_EMBED_SEARCH_TEXT')"
}
```

```json
{
"name": "searchText",
"auto-embed": "@akv('auto-embed-search-text')"
}
```

## Legacy parameter format

`auto-embed` is only supported in the array-based `source.parameters` format.

The deprecated dictionary parameter format doesn't support `auto-embed`.

Example not supported:

```json
{
"source": {
"object": "dbo.SearchProducts",
"type": "stored-procedure",
"parameters": {
"searchText": ""
}
}
}
```

## Runtime dependency

`auto-embed` depends on the existing runtime embedding subsystem.

The public `/embed` endpoint doesn't need to be enabled. The internal embedding service must be configured and available.

There is only one embedding configuration. Parameters don't select providers, models, deployments, dimensions, or profiles.

## API support

`auto-embed` applies to all stored procedure execution paths:

```text
REST GET query string
REST POST body
GraphQL query or mutation arguments
MCP execute-entity
MCP custom tool arguments
```

This is not MCP-only.

## Execution order

DAB must not call the embedding subsystem until the request is valid and authorized.

Order:

```text
Authenticate request
Validate request shape
Validate required parameter rules
Authorize execute permission
Resolve configured defaults
Evaluate auto-embed parameters
Call embedding subsystem
Replace parameter values
Execute stored procedure
```

If the role can execute the stored procedure, `auto-embed` applies. There is no separate embedding permission.

## Value behavior

`auto-embed` only changes behavior for parameters that have a resolved value from the caller or from a DAB configured default.

If an optional `auto-embed` parameter is omitted and has no configured default, DAB keeps existing behavior and omits the parameter.

Before deciding whether to embed, DAB trims the value for validation only.

If the trimmed value has at least one character, DAB sends the original string value to the embedding subsystem.

If the value is `null`, empty, or whitespace-only, DAB passes an empty string to the stored procedure.

```text
omitted optional parameter with no default -> existing behavior
omitted optional parameter with null configured default -> ""
omitted optional parameter with empty configured default -> ""
caller passes null -> ""
caller passes "" -> ""
caller passes " " -> ""
caller passes "cat" -> embedding string
caller passes " cat " -> embedding string for " cat "
```

## Type rules

The API treats every `auto-embed` parameter as a string.

Input is a string.

Output to the stored procedure is a string.

The stored procedure parameter must be string-compatible according to database metadata.

Examples:

```text
char
varchar
nchar
nvarchar
text
ntext
```

Preferred:

```text
varchar
nvarchar
```

If database metadata reports a non-string-compatible type, startup validation fails.

## Validation

`dab validate` and runtime startup must validate:

```text
auto-embed appears only on explicit stored procedure parameters
the named parameter exists
the parameter is string-compatible
runtime.embeddings is configured and valid
the database provider can support the required metadata checks
```

The JSON schema should allow `auto-embed` on stored procedure parameter objects. Runtime validation decides provider and metadata support.

`RuntimeConfigValidator` must validate `runtime.embeddings` when any stored procedure parameter has `auto-embed: true`.

## Embedding result handling

DAB doesn't inspect, parse, validate, or reshape the embedding result.

The embedding subsystem returns a value. DAB treats it as a string and passes it to the stored procedure.

If embedding fails, DAB must not execute the stored procedure.

## Multiple parameters

A stored procedure can have any number of `auto-embed` parameters.

Each parameter is embedded independently.

Batching is allowed as an optimization when the embedding subsystem supports it, but it isn't required.

DAB should prefer the embedding subsystem’s batch API when more than one parameter needs embedding in the same stored procedure call.

If batching is used, every item must succeed. If any item fails, the request fails and the stored procedure is not executed.

## Concurrency and timeout behavior

The embedding subsystem owns timeout behavior. `auto-embed` must respect that timeout and fail the request if embedding doesn't complete successfully.

DAB must not introduce a separate concurrency limit or timeout setting for `auto-embed`.

If multiple embedding calls are made without batching, each call must use the embedding subsystem behavior as configured.

## Error behavior

If `auto-embed` is enabled and DAB can't produce an embedding, the request fails.

DAB must not pass the original text to the stored procedure after an embedding failure.

Suggested responses:

```text
400 Bad Request
The value can't be embedded because the input is invalid.

502 Bad Gateway
The embedding provider failed or returned an invalid response.

503 Service Unavailable
The embedding subsystem is configured but unavailable.

500 Internal Server Error
Unexpected DAB embedding pipeline failure.
```

API responses should include a useful sanitized error:

```text
embedding failed
provider status code
provider error code
sanitized provider message
correlation ID
```

Responses must not include:

```text
original input text
embedding value
API key
authorization headers
full raw provider response body
```

## Metadata

`auto-embed` must appear in generated metadata.

The input type remains `string`.

Expose the behavior through metadata or description in:

```text
REST OpenAPI
GraphQL schema metadata
MCP describe_entities
MCP custom tool input schema or tool description
```

Example metadata intent:

```json
{
"name": "searchText",
"type": "string",
"autoEmbed": true,
"description": "Send plain text. DAB converts this value to an embedding before executing the stored procedure."
}
```

## Telemetry

`auto-embed` must emit logs and OpenTelemetry traces.

Include:

```text
entity name
stored procedure name
parameter name
auto-embed enabled
embedding attempted
embedding succeeded or failed
duration
provider status code when available
provider error code when available
sanitized provider message when available
correlation ID
provider request ID when available
provider/model metadata if already exposed by embedding subsystem
```

Never include:

```text
original input text
embedding value
stored procedure parameter value after embedding
API key
authorization headers
full raw provider response body
```

## CLI

Add `--parameters.auto-embed` to `dab add` and `dab update`.

It follows the same aligned list pattern as existing parameter options.

Example:

```sh
dab add SearchProducts \
--source dbo.SearchProducts \
--source.type stored-procedure \
--parameters.name "searchText,categoryText" \
--parameters.required "true,false" \
--parameters.auto-embed "true,true" \
--permissions "anonymous:execute"
```

Example update:

```sh
dab update SearchProducts \
--parameters.name "searchText,categoryText" \
--parameters.auto-embed "true,false"
```

## Documentation

Update CLI docs for `dab add` and `dab update`.

Add:

```text
--parameters.auto-embed
Stored procedures only. Comma-separated list of true/false values aligned to --parameters.name.
```

Update the stored procedure examples to include:

```sh
--parameters.auto-embed "true,false"
```

## Schema change

Add `auto-embed` to stored procedure parameter objects.

Suggested schema addition inside parameter item properties:

```json
"auto-embed": {
"$ref": "#/$defs/boolean-or-string",
"description": "When true, DAB sends the parameter value to the configured embedding subsystem and passes the returned embedding string to the stored procedure.",
"default": false
}
```

## Acceptance criteria

A stored procedure parameter can set `auto-embed: true`.

`auto-embed` defaults to `false`.

`auto-embed` supports literal booleans, `@env()`, and `@akv()`.

`auto-embed` is only supported in the array-based `source.parameters` format.

The deprecated dictionary parameter format doesn't support `auto-embed`.

`dab validate` fails if `auto-embed` is true and runtime embeddings are not configured or valid.

Runtime startup fails under the same invalid conditions as `dab validate`.

DAB rejects `auto-embed` on non-explicit parameters.

DAB rejects `auto-embed` when the database parameter type is not string-compatible.

DAB applies `auto-embed` after request validation and execute authorization.

DAB supports REST, GraphQL, MCP `execute-entity`, and MCP custom tools.

DAB embeds configured default values when the caller omits the parameter and the config default resolves to a non-empty string.

DAB doesn't embed omitted optional parameters with no configured default.

DAB passes empty string for null, empty, or whitespace-only resolved values.

DAB sends the original string value to the embedding subsystem when embedding occurs.

DAB doesn't execute the stored procedure if embedding fails.

DAB exposes `auto-embed` in OpenAPI, GraphQL, and MCP metadata.

DAB emits logs and OTEL traces without logging original text or embedding values.

DAB uses the embedding subsystem timeout and failure behavior.

DAB doesn't add a new timeout setting for `auto-embed`.

DAB doesn't add a new concurrency setting for `auto-embed`.

`dab add` and `dab update` support `--parameters.auto-embed`.

MS Learn CLI docs are updated for `dab add` and `dab update`.