fix: filter embedding API key errors and harden beforeSend patterns (#477)

## Summary

Fix three more Sentry issues and harden the beforeSend filter to
suppress additional non-actionable errors.

### LOREAI-GATEWAY-1G / 1H — OpenAI API 401 with placeholder key

**Root cause:** `pickRemoteFallback()` treated any truthy
`OPENAI_API_KEY` as valid. Tools like Codex set `OPENAI_API_KEY=nokey`
as a placeholder when routing through a custom `OPENAI_BASE_URL`. When
the local embedding provider fails, the fallback used this placeholder
key to make real requests to `https://api.openai.com/v1/embeddings`,
producing 401 errors.

**Fix:** Added `looksLikeApiKey()` validation — keys shorter than 20
characters are rejected as placeholders, falling through to FTS-only
search. Also added `/Incorrect API key/i` to the beforeSend filter as
defense-in-depth.

### LOREAI-GATEWAY-1A — getSystemErrorMap crash in Sentry SDK on Bun

**Root cause:** Bun doesn't implement `getSystemErrorMap()` from
`node:util`. The Sentry SDK calls this during error processing, creating
an infinite crash loop (original error → captureException → SDK internal
processing → getSystemErrorMap crash → unhandled error).

**Fix:** Added `/getSystemErrorMap/` to the beforeSend filter to
suppress this Sentry SDK internal failure.

### Additional beforeSend hardening

Added patterns for ONNX-related init failures that were slipping through
on various platforms:
- `/onnxruntime/i` — general ONNX runtime errors
- `/Cannot find package 'onnxruntime-node'/` — missing ONNX package
(LOREAI-GATEWAY-18)
- `/LoadLibrary failed/` — Windows ONNX DLL load failure
(LOREAI-GATEWAY-15)
- `/Protobuf parsing failed/` — corrupt/incompatible ONNX model file
(LOREAI-GATEWAY-10)

## Test Plan

- All 1915 existing tests pass (1 new test added for placeholder key
rejection)
- Typecheck passes across all packages

Closes LOREAI-GATEWAY-1G, LOREAI-GATEWAY-1H, LOREAI-GATEWAY-1A