feat(harness): port vectorstore dual-key + reader RPC (D11, §5.4)

Ports vectorstore/{rest_client,rest_writer,store,reader,embeddings,records},
evidence/model (leaf dep of records), and cli/_guards (require_vector_write_allowed
workstation write-guard). Renamed psdwp3->nsp, verbatim.

VectorRestClient gains an api_key property so reader/writer clients carry their
distinct keys visibly (spec D11: vector_reader / vector_writer on the same endpoint).

scripts/create_vector_reader_rpc.sql is NEW: the reader RPCs (search_similar,
list_tables) lived server-side in Supabase and were never versioned. Authored now
mirroring the writer allowlist pattern (table allowlist, security definer, revoke
from anon/authenticated, grant to vector_reader only). Writer RPC ported verbatim.

L1: test_vector_dual_key (7 tests) pins the dual-key construction + the workstation
write-guard (exit 4 without writer key).

harness/nsp/vectorstore/rest_client.py

@@ -0,0 +1,104 @@
+"""Client per la similarity search del pgvector esposta via Supabase/PostgREST.
+
+Endpoint dedicato (es. https://host/vector/v1/), distinto dal DWH. La lettura usa
+`search_similar`; la scrittura remota usa RPC allowlist con una API key separata.
+Errori in italiano e azionabili, stile `rest/client.py`.
+"""
+
+import requests
+
+from nsp.config import RestConfig
+
+
+class VectorRestError(Exception):
+    """Errore di accesso al vector store via REST, con messaggio leggibile per il reviewer."""
+
+
+class VectorRestClient:
+    def __init__(self, cfg: RestConfig):
+        self.cfg = cfg
+        self._base = cfg.base_url.rstrip("/")
+
+    @property
+    def api_key(self) -> str:
+        """The REST API key for this client (spec D11: reader and writer carry
+        distinct keys against the same endpoint)."""
+        return self.cfg.api_key
+
+    def _post(self, fn: str, args: dict) -> requests.Response:
+        url = f"{self._base}/rpc/{fn}"
+        verify: bool | str = self.cfg.ssl_ca if self.cfg.ssl_ca else True
+        try:
+            return requests.post(
+                url,
+                json=args,
+                headers={"X-API-Key": self.cfg.api_key},
+                timeout=self.cfg.timeout,
+                verify=verify,
+            )
+        except requests.RequestException as e:
+            raise VectorRestError(
+                f"Vector REST non raggiungibile su {self.cfg.base_url} (rpc {fn}): {e}"
+            ) from e
+
+    def _error_msg(self, fn: str, resp: requests.Response) -> str:
+        try:
+            body = resp.json()
+            detail = body.get("message") or body.get("details") or resp.text
+        except Exception:
+            detail = resp.text
+        return f"Vector REST rpc {fn} → HTTP {resp.status_code}: {detail}"
+
+    def _call(self, fn: str, args: dict):
+        resp = self._post(fn, args)
+        if not resp.ok:
+            raise VectorRestError(self._error_msg(fn, resp))
+        if resp.status_code == 204 or not resp.text:
+            return None
+        return resp.json()
+
+    def search_similar(
+        self, table_name: str, query_embedding: list[float], limit_count: int
+    ) -> list[dict]:
+        """Ricerca per similarità coseno su `vectors.<table_name>`: ritorna le righe
+        `{id, similarity, metadata}` ordinate per similarity decrescente."""
+        return self._call(
+            "search_similar",
+            {
+                "query_embedding": query_embedding,
+                "limit_count": limit_count,
+                "table_name": table_name,
+            },
+        ) or []
+
+    def list_tables(self) -> list[dict]:
+        """Tabelle vettoriali disponibili: `{table_name, vector_dimensions, …}`."""
+        return self._call("list_tables", {}) or []
+
+    def existing_hashes(self, table_name: str, kinds: list[str]) -> dict[str, str]:
+        """Hash correnti per sync incrementale su una tabella vector allowlisted.
+
+        RPC attesa: `existing_vector_hashes(table_name, kinds)` -> righe
+        `{record_key, content_hash}`.
+        """
+        rows = self._call(
+            "existing_vector_hashes",
+            {"table_name": table_name, "kinds": kinds},
+        ) or []
+        return {row["record_key"]: row["content_hash"] for row in rows}
+
+    def upsert_records(self, table_name: str, rows: list[dict]) -> int:
+        """Upsert controllato di record vettoriali già embeddati.
+
+        RPC attesa: `upsert_vector_records(table_name, rows)` -> `{upserted: N}` o righe.
+        Non espone delete/clear: il cleanup distruttivo resta solo-server.
+        """
+        payload = self._call(
+            "upsert_vector_records",
+            {"table_name": table_name, "rows": rows},
+        )
+        if payload is None:
+            return len(rows)
+        if isinstance(payload, dict):
+            return int(payload.get("upserted", len(rows)))
+        return len(payload) if isinstance(payload, list) else len(rows)