Handle Vimeo embed privacy for non-embeddable clips

O3r and future imports with embed_privacy=nowhere show a poster
link to Vimeo instead of a blocked iframe player.

server/src/services/vimeo-import.ts

@@ -87,6 +87,8 @@ interface VimeoSimpleVideo {
   tags?: string;
   width?: number;
   height?: number;
+  /** anywhere | nowhere | whitelist — "nowhere" blocks iframe embeds */
+  embed_privacy?: string;
 }
 
 async function listVideos(username: string): Promise<VimeoSimpleVideo[]> {
@@ -271,21 +273,38 @@ export async function runVimeoImport(
         }
       }
 
-      // Vimeo embed media
+      // Embed only when Vimeo allows it (embed_privacy: anywhere / whitelist)
+      const canEmbed =
+        !video.embed_privacy ||
+        video.embed_privacy === "anywhere" ||
+        video.embed_privacy === "whitelist";
+
       await prisma.media.create({
         data: {
           projectId: project.id,
           type: "video",
-          url: `https://player.vimeo.com/video/${video.id}`,
+          // Non-embeddable clips use the watch page URL (no player.vimeo.com iframe)
+          url: canEmbed
+            ? `https://player.vimeo.com/video/${video.id}`
+            : sourceUrl,
           externalUrl: sourceUrl,
           videoSource: "vimeo",
           videoId: String(video.id),
-          caption: title,
+          caption: canEmbed
+            ? title
+            : `${title} (opens on Vimeo — embedding disabled by privacy settings)`,
           sortOrder: 1,
           width: video.width,
           height: video.height,
         },
       });
+      if (!canEmbed) {
+        log(
+          lines,
+          onLog,
+          `    note: embed privacy “${video.embed_privacy}” — link-out card instead of iframe`
+        );
+      }
 
       if (thumbnailId) {
         await prisma.project.update({