feat: dedup shared-file parsing/embedding across users in vector sync

A file shared across many users — directly, or via a group folder shared
to a group — was parsed and embedded once per user. Chunk point IDs are
user-agnostic (uuid5(tenant_id, doc_id=fileid, chunk_index)), but the
per-user freshness gate filtered Qdrant by user_id, so two readers
ping-ponged: each overwrote the other's points and each kept seeing "not
indexed for me", reprocessing every scan. Production telemetry (note
386945, finding #5) measured identical docs re-processed every few hours
at 7-13s each, with PDF parse ~62% of per-doc cost.

Layer 1 — tenant-wide dedup:
- Thread the scanner's tag-REPORT etag into the file DocumentTask and the
  chunk payload; index `etag` as a KEYWORD field.
- vector/sharing_state.find_indexed_content scrolls tenant-wide (no
  user_id filter) for a non-placeholder point matching
  (doc_id, doc_type, etag), gated on embedding_identity in Python so a
  model switch correctly forces a re-embed.
- Scanner skips enqueue and the processor skips fetch/parse/embed when a
  match exists (cross-worker race-guard before WebDAV read). Dedup is
  fail-safe: a Qdrant error degrades to "process normally".

Layer 2 — observed-access ACL (no admin / GroupFolders API needed):
- Each point carries `acl_principals` = the set of user:<uid> whose
  scanner has observed (hence can read) the file. The per-user tag REPORT
  is the access oracle; group membership/GroupFolders enumeration is
  admin-only and unavailable in multi-user modes.
- build_ownership_filter ORs MatchAny(acl_principals, ["user:<me>"]) so a
  deduplicated shared/group-folder point surfaces to every reader;
  verify-on-read (_verify_files) remains the precise ACL gate.
- Deletion/eviction become "release one user": drop the principal and
  delete the points only when the set empties, so one user untagging a
  shared file doesn't evict it for the others. Legacy points without the
  field keep the original per-user delete.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/vector/qdrant_client.py

@@ -70,6 +70,19 @@ _PAYLOAD_INDEX_FIELDS: dict[str, PayloadSchemaType] = {
     # migration like modified_at. Local/embedded qdrant-client matches by
     # substring without an index, so dev stacks work without it too.
     "file_path": PayloadSchemaType.TEXT,
+    # etag is the tenant-wide content-dedup key: the scanner/processor scroll for
+    # a non-placeholder point matching (doc_id, doc_type, etag) to decide whether
+    # a file's content is already indexed and reprocessing can be skipped (see
+    # vector/sharing_state.find_indexed_content). KEYWORD for exact match; the
+    # value is the Nextcloud etag already written to every point. Idempotent
+    # startup migration like the fields above.
+    "etag": PayloadSchemaType.KEYWORD,
+    # acl_principals is the observed-access ACL set ("user:<uid>" entries). Search
+    # ORs MatchAny(key="acl_principals", any=["user:<me>"]) so a deduplicated
+    # shared point reaches every reader's candidate set (see
+    # search/access_filter.build_ownership_filter); KEYWORD indexes match array
+    # membership element-wise. Idempotent startup migration.
+    "acl_principals": PayloadSchemaType.KEYWORD,
 }
 
 # Sentinel point that records "this collection has been backfilled to str