fix: PR #813 review — shared-file context in MCP tool path + viz over-fetch cap

🟡 Important: nc_semantic_search's include_context branch did not forward
accessible_owners to get_chunk_with_context, so context expansion for shared
files stayed self-only, found nothing in Qdrant, and silently fell back to the
plain excerpt. Forward accessible_owners (the per-file file_accessible_by_id
gate still enforces access).

🟡 Performance: auth/viz_routes.py's multi-doc_type branch sorted but did not
cap the candidate pool before verify-on-read, so N doc_types × limit*2 went
into verification (N× the Nextcloud round-trips). Cap to limit*2 after the
sort, matching server/semantic.py and the cross-app branch.

Also clear the SonarCloud gate (new_duplicated_lines_density 5.1% > 3%) the
ACL wiring introduced: extract the duplicated /api/v1 client-resolution +
owner-expansion + verify-on-read block from unified_search/vector_search into a
shared _search_with_acl helper, define a constant for the repeated
"Nextcloud host not configured" literal (S1192), and reword the access_filter
move_to_end comment so it isn't misread as commented-out code (S125) while
adding the other-owner count to its debug log (review nits).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/viz_routes.py

@@ -224,8 +224,13 @@ async def vector_visualization_search(request: Request) -> JSONResponse:
                             accessible_owners=accessible_owners,
                         )
                     all_results.extend(unverified_results)
-                # Sort by score before verification
+                # Sort by score, then cap to the same limit*2 over-fetch budget
+                # as the cross-app branch and the nc_semantic_search tool path
+                # (server/semantic.py). Without this, N doc_types each fetched
+                # at limit*2 would send N*limit*2 candidates into verify-on-read,
+                # multiplying the Nextcloud round-trip cost (and latency) by N.
                 all_results.sort(key=lambda r: r.score, reverse=True)
+                all_results = all_results[: limit * 2]
 
             # Verify-on-read (ADR-019). Now that accessible_owners is expanded
             # via OCS shares, the result set can include OTHER users' shared