perf: cache hot-path work in retrieval, logging, and health

[CGFixIT]

Summary

Four low-risk performance optimizations on frequently-executed code paths. Each was verified against the actual code (and functionally exercised) rather than applied blindly — a couple of candidate findings were discarded as incorrect or already implemented.

Optimizations

1. retrieval/embeddings.py — memoize query embeddings (highest impact)
   get_embedding() ran a full SentenceTransformer forward pass on every call, including for repeated query text. It now caches results via lru_cache. The cached value is an immutable tuple and get_embedding returns a fresh list copy, so callers cannot poison the cache. Added reset_embedding_cache().

2. utils/logger.py — precompile redaction regexes
   redact_sensitive() runs on every audited field of every query and previously recompiled its email/IP/secret regexes each call. Patterns are now compiled once per privacy configuration (keyed on the hashable privacy settings, so a config change still yields a fresh set). Signature unchanged.

3. utils/health.py — cache parsed config per path
   check_all() runs on every /health request and re-read + re-parsed config.yaml each time. Config is now parsed once per path via lru_cache.

4. utils/personality.py — remove dead code
   Deleted a duplicated _SQL_INSERT_SOUL_VERSION definition (the first was immediately overwritten by an identical reassignment).

Discarded candidates (for the record)

• Storing stem_tags as a native list in ChromaDB metadata — not possible; ChromaDB metadata only accepts scalar types, so json.dumps is required.
• "Config not cached" in embeddings.py / logger.py — already cached at HEAD.
• Hybrid-merge dict consolidation & micro config-lookup hoisting — skipped as risky/negligible.

Verification

• Syntax-checked all four files.
• Functionally exercised the changed logic directly (deps stubbed where chromadb/torch aren't installable in this env):
  • logger redaction produces correct output incl. malformed-regex skip;
  • embedding cache returns hits and the copy-on-return prevents mutation poisoning;
  • health config returns the same cached object across calls.
• Confirmed existing callers/tests remain compatible (redact_sensitive(text, cfg) signature preserved; _SQL_INSERT_SOUL_VERSION still defined once and used at 4 call sites; check_all is patched in gate tests).

Note: the full pytest suite couldn't run in this environment because chromadb/torch aren't installed (conftest imports them). Recommend running pytest in CI to confirm.

🤖 Generated with Claude Code

---

Generated by Claude Code