fix(server): reject remote graph entries at config load

omnigraph-server serves embedded graphs only (RFC-002 §3). Classify each served
graph with the typed `config.resolve_graph(...).is_remote()` — the same locator
classifier the CLI dispatches on — and `bail!` early with a clear "embedded
graphs only" error if a graph sets `server:` or a remote `http(s)://` `uri:`,
instead of accepting it and failing confusingly later at `Omnigraph::open`.

Both modes covered: Single (hoist `selected` above the URI resolution and check
before `cli_uri` is moved) and Multi (per entry, after the `GraphId` check). A new
`ensure_embedded` helper keeps the message in one place. No config-crate change
(reuses existing public `resolve_graph`/`is_remote`); embedded `storage:`/`uri:`
entries pass through unchanged (positive guard test added).

Updates the `server_settings_can_resolve_named_target` lib test, which asserted
the old behavior (server resolves a remote named target); it now uses an embedded
target — the remote case is rejected and covered by
`single_mode_rejects_named_remote_graph`. Turns the previous commit's four red
tests green.

crates/omnigraph-server/tests/server.rs

@@ -5964,6 +5964,31 @@ graphs:
         );
     }
 
+    #[test]
+    fn multi_mode_accepts_storage_embedded_entry() {
+        // The rejection must NOT over-fire on an embedded `storage:` entry:
+        // `normalize_graphs` fills `.uri` and the server serves it normally.
+        let temp = tempfile::tempdir().unwrap();
+        let config_path = temp.path().join("omnigraph.yaml");
+        fs::write(
+            &config_path,
+            "version: 1\ngraphs:\n  g:\n    storage: ./g.omni\n",
+        )
+        .unwrap();
+        let settings = load_server_settings(Some(&config_path), None, None, None, true).unwrap();
+        match settings.mode {
+            ServerConfigMode::Multi { graphs, .. } => {
+                assert_eq!(graphs.len(), 1);
+                assert!(
+                    graphs[0].uri.ends_with("g.omni"),
+                    "storage entry must resolve to its embedded uri: {}",
+                    graphs[0].uri
+                );
+            }
+            ServerConfigMode::Single { .. } => panic!("expected Multi for a graphs: map"),
+        }
+    }
+
     /// `--config` + `<URI>` together: URI wins → Single (the CLI URI
     /// takes precedence over the config's graphs map).
     #[test]