fix(rag): do not mark a document indexed when no chunk could be embedded

With the embedding server unavailable every chunk failed, yet the document
was stored as indexed=true with 0 chunks, so the knowledge base listed it as
searchable while queries could never match it. The red use-case test caught
this; it had been written off as an environment failure.

Now a run with zero embedded chunks leaves indexed=false and throws
RAGEmbeddingFailed (surfaced by reindex, logged by addDocument).

Tests that only hold on the Windows developer machine now declare it: the
bundled SoX binary and PowerShell device discovery run on win32 only, and
the sidecar venv test runs only when sidecar/.venv exists. The Linux Forgejo
runner skips them instead of failing.

apps/desktop/src/main/services/RAGService.ts

@@ -292,13 +292,27 @@ ${context}`
       await new Promise((r) => setTimeout(r, 10))
     }
 
+    this._state = 'idle'
+
+    // 한 청크도 임베딩하지 못했으면(임베딩 서버 없음 등) 색인됐다고 표시하지 않는다.
+    // indexed=true + 0 chunks 로 두면 문서가 검색 가능한 것처럼 보이지만 질의에 걸리지 않는다.
+    if (successCount === 0) {
+      db.update(ragDocuments)
+        .set({ indexed: false, indexedAt: null })
+        .where(eq(ragDocuments.id, docId))
+        .run()
+      throw new D3ROError(
+        ErrorCode.RAGEmbeddingFailed,
+        `No chunk of ${fileName} could be embedded (${chunks.length} attempted)`,
+      )
+    }
+
     // 인덱싱 완료 표시
     db.update(ragDocuments)
       .set({ indexed: true, indexedAt: Date.now(), chunkCount: successCount })
       .where(eq(ragDocuments.id, docId))
       .run()
 
-    this._state = 'idle'
     this._sendToRenderer(IPC_CHANNELS.RAG.INDEX_COMPLETE, { documentId: docId, fileName })
     logger.info(`RAG indexing complete: ${fileName} (${successCount}/${chunks.length} chunks embedded)`)
   }