feat: add embedding extraction endpoint

[Dzejkop]

Summary

• add a sealed POST /v1/extract-embedding API for extracting an enrollment embedding from one image
• relay requests through the untrusted host and perform extraction inside the enclave
• return the Face Engine vector with its type, version, and inference-backend metadata
• expose request_extract_embedding in deepface-client and document the new flow

Privacy behavior

The image, extracted embedding, and input-derived failures remain sealed end-to-end. The host learns only whether the enclave answered. Malformed inputs, unsupported protocol versions, and image-analysis failures are returned inside ExtractEmbeddingResult.

Testing

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --locked
• cargo clippy --workspace --all-targets --locked -- -D warnings (deepface/enclave)
• cargo test --workspace --locked (deepface/enclave)