fix: PR #813 review — shared-file context in MCP tool path + viz over-fetch cap

🟡 Important: nc_semantic_search's include_context branch did not forward
accessible_owners to get_chunk_with_context, so context expansion for shared
files stayed self-only, found nothing in Qdrant, and silently fell back to the
plain excerpt. Forward accessible_owners (the per-file file_accessible_by_id
gate still enforces access).

🟡 Performance: auth/viz_routes.py's multi-doc_type branch sorted but did not
cap the candidate pool before verify-on-read, so N doc_types × limit*2 went
into verification (N× the Nextcloud round-trips). Cap to limit*2 after the
sort, matching server/semantic.py and the cross-app branch.

Also clear the SonarCloud gate (new_duplicated_lines_density 5.1% > 3%) the
ACL wiring introduced: extract the duplicated /api/v1 client-resolution +
owner-expansion + verify-on-read block from unified_search/vector_search into a
shared _search_with_acl helper, define a constant for the repeated
"Nextcloud host not configured" literal (S1192), and reword the access_filter
move_to_end comment so it isn't misread as commented-out code (S125) while
adding the other-owner count to its debug log (review nits).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/search/access_filter.py

@@ -124,10 +124,18 @@ async def list_accessible_owners(
 
     result = list(owners)
     _owners_cache[user_id] = (now, result)
-    _owners_cache.move_to_end(user_id)  # newest = most-recently-used
+    # Promote to the most-recently-used end. This is a no-op for a brand-new
+    # key (dict insertion already appends) but is needed when re-inserting an
+    # existing key after its TTL expired.
+    _owners_cache.move_to_end(user_id)
     while len(_owners_cache) > _OWNERS_CACHE_MAXSIZE:
-        _owners_cache.popitem(last=False)  # evict least-recently-used
-    logger.debug("Accessible owners for user %s: %d entries", user_id, len(result))
+        _owners_cache.popitem(last=False)  # evict the least-recently-used entry
+    logger.debug(
+        "Accessible owners for user %s: %d entries (%d other owner(s))",
+        user_id,
+        len(result),
+        len(result) - 1,
+    )
     return list(result)