Low-severity hardening: /metrics auth, embedding error echo, filter IN cap, /random include flags

[Coriou]

Surfaced by the 2026-06-29 maintenance audit (PR #2). A bundle of small, independent hardening/parity items — each safe to pick off individually.

• /metrics is unauthenticated when enabled (src/server.ts, behind UPVECTOR_METRICS) — exposes request counts/latencies/configured metric to anyone who can reach the port. Document the expectation (network policy) or put it behind auth.
• Upstream embedding error text echoed to clients (src/embedding.ts) — the provider error message (sliced to 300 chars) is returned in the 502 body, leaking provider/model details. Genericize the client-facing message; keep detail in logs.
• Filter IN (...) value-list has no element-count cap (src/filter/parser.ts) — only bounded by MAX_FILTER_LENGTH=8192. Add an explicit cap for defense-in-depth.
• /random ignores include flags (src/routes/random.ts) — always returns { id, vector }, never metadata/data. Not part of the SDK's Index surface, so low impact, but the REST shape likely diverges from Upstash.

Acceptance criteria

Each checkbox addressed (or consciously declined with a note). No behavior change required for the default happy path.