feat(search): ACL-aware vector filter via Nextcloud Shares lookup

The vector index has always been strictly per-user: every Qdrant payload
carries a `user_id` and the search filter is `user_id == querying_user`.
A file Alice indexed cannot be discovered by Bob even if she has shared
it with him — Bob would have to re-index it under his own user_id to
make it searchable, which means duplicate index entries for every share
recipient.

Switch to ownership-with-ACL-expansion:

- New `nextcloud_mcp_server.search.access_filter` module:
  - `list_accessible_owners(sharing_client, user_id)` calls the OCS
    Sharing API (`shared_with_me=true`) and returns
    `{user_id} ∪ {uid_owner of each share}`. Fails open to `[user_id]`
    so a misbehaving Sharing API doesn't black-hole search.
  - `build_ownership_filter(user_id, accessible_owners)` returns a
    Qdrant `Filter` whose `should` branch matches either the new
    `owner_id IN accessible_owners` field or the legacy `user_id` field.
    The legacy branch keeps points indexed before this change reachable
    without a migration backfill.
- Indexer payload (`vector/processor.py`) now writes `owner_id` alongside
  `user_id`. `DocumentTask` gains an optional `owner_id` field; today the
  scanner always runs as the owner so the processor falls back to
  `user_id`, but the field is plumbed so a future shared-with-me crawler
  can set the true owner without reshaping the payload contract.
- `SemanticSearchAlgorithm.search` and `BM25HybridSearchAlgorithm.search`
  accept `accessible_owners` via kwargs and use the new ownership filter.
  Default behaviour with no kwarg is unchanged (self-only).
- Both user-facing callers — the MCP tool path (`server/semantic.py`) and
  the visualization Starlette route (`auth/viz_routes.py`) — compute
  `accessible_owners` from the authenticated Nextcloud client before
  invoking the search algorithm. Eviction, scanner deletion, placeholder,
  and chunk-context paths intentionally keep the legacy `user_id`
  semantics (those are "operations on a specific user's records", not
  cross-user reads).
- 10 new unit tests in `tests/unit/search/test_access_filter.py` cover
  self-only default, owner expansion, dedup, fallback fields, OCS
  failure, and the legacy `should`-branch shape.

Pairs with cbcoutinho/astrolabe#89 — together they let an Astrolabe user
find content owners have shared with them without going through any
re-authorization flow or re-indexing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/search/test_access_filter.py

@@ -0,0 +1,118 @@
+"""Tests for nextcloud_mcp_server.search.access_filter."""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock
+
+import pytest
+
+from nextcloud_mcp_server.search.access_filter import (
+    build_ownership_filter,
+    list_accessible_owners,
+)
+
+
+class TestListAccessibleOwners:
+    @pytest.mark.unit
+    async def test_includes_self_even_with_no_shares(self) -> None:
+        sharing = AsyncMock()
+        sharing.list_shares.return_value = []
+
+        owners = await list_accessible_owners(sharing, "alice")
+        assert owners == ["alice"]
+
+    @pytest.mark.unit
+    async def test_collects_uid_owner_from_shares(self) -> None:
+        sharing = AsyncMock()
+        sharing.list_shares.return_value = [
+            {"uid_owner": "bob", "share_with": "alice"},
+            {"uid_owner": "carol", "share_with": "alice"},
+        ]
+
+        owners = await list_accessible_owners(sharing, "alice")
+        assert set(owners) == {"alice", "bob", "carol"}
+
+    @pytest.mark.unit
+    async def test_deduplicates_repeated_owners(self) -> None:
+        sharing = AsyncMock()
+        sharing.list_shares.return_value = [
+            {"uid_owner": "bob"},
+            {"uid_owner": "bob"},  # same owner shares many files
+            {"uid_owner": "bob"},
+        ]
+
+        owners = await list_accessible_owners(sharing, "alice")
+        assert sorted(owners) == ["alice", "bob"]
+
+    @pytest.mark.unit
+    async def test_falls_back_to_owner_field_when_uid_owner_missing(self) -> None:
+        # Some Nextcloud versions surface `owner` instead of `uid_owner`
+        # on the shared-with-me response.
+        sharing = AsyncMock()
+        sharing.list_shares.return_value = [{"owner": "bob"}]
+
+        owners = await list_accessible_owners(sharing, "alice")
+        assert sorted(owners) == ["alice", "bob"]
+
+    @pytest.mark.unit
+    async def test_ignores_share_with_no_owner_field(self) -> None:
+        sharing = AsyncMock()
+        sharing.list_shares.return_value = [
+            {"id": 42},  # malformed share entry
+            {"uid_owner": "bob"},
+            {"uid_owner": 12345},  # non-string owner — skip
+        ]
+
+        owners = await list_accessible_owners(sharing, "alice")
+        assert sorted(owners) == ["alice", "bob"]
+
+    @pytest.mark.unit
+    async def test_degrades_to_self_on_sharing_api_failure(self) -> None:
+        sharing = AsyncMock()
+        sharing.list_shares.side_effect = RuntimeError("OCS down")
+
+        owners = await list_accessible_owners(sharing, "alice")
+        # Fail-open to "self only" rather than blowing up search.
+        assert owners == ["alice"]
+
+    @pytest.mark.unit
+    async def test_calls_shared_with_me(self) -> None:
+        sharing = AsyncMock()
+        sharing.list_shares.return_value = []
+
+        await list_accessible_owners(sharing, "alice")
+        sharing.list_shares.assert_awaited_once_with(shared_with_me=True)
+
+
+class TestBuildOwnershipFilter:
+    def test_defaults_to_self_only_when_owners_omitted(self) -> None:
+        flt = build_ownership_filter("alice")
+
+        assert flt.should is not None
+        assert len(flt.should) == 2  # owner_id branch + legacy user_id branch
+        owner_branch, user_branch = flt.should
+        assert owner_branch.key == "owner_id"
+        assert owner_branch.match.any == ["alice"]
+        assert user_branch.key == "user_id"
+        assert user_branch.match.value == "alice"
+
+    def test_expands_owner_branch_with_accessible_owners(self) -> None:
+        flt = build_ownership_filter("alice", ["alice", "bob", "carol"])
+
+        owner_branch, user_branch = flt.should
+        # Owner branch reflects the expanded set.
+        assert set(owner_branch.match.any) == {"alice", "bob", "carol"}
+        # Legacy user_id branch keeps the original user — that's the only
+        # legacy match path, so it must NOT widen to other owners.
+        assert user_branch.match.value == "alice"
+
+    def test_explicit_empty_list_still_keeps_legacy_branch(self) -> None:
+        # Edge case: caller passed an explicit empty list. We shouldn't
+        # silently re-default to [user_id] in the owner branch, but the
+        # legacy branch is still the safety net so the user can find their
+        # own content from before the migration.
+        flt = build_ownership_filter("alice", [])
+
+        owner_branch, user_branch = flt.should
+        assert owner_branch.match.any == []
+        assert user_branch.match.value == "alice"