Function classify_intent 

pub async fn classify_intent(query: &str, api_url: &str) -> IntentClass

Classify user query intent using embedding similarity against labeled centroids.

Only called when the keyword router has already returned host_inspection_mode = true, so this is a veto path, not the primary routing path. Returning Ambiguous is always safe — it just falls through to existing behavior.