fix: address PR #813 latest review (ACL-aware doc-type discovery, robustness)

- get_indexed_doc_types: add optional accessible_owners param and reuse
  build_ownership_filter so cross-user doc-type discovery matches the real
  search scope (was self-only / ACL-blind); docstring documents the self-only
  default. Covered by test_get_indexed_doc_types_is_acl_aware.
- access_filter: build_ownership_filter now omits the owner_id branch entirely
  for an empty owner set instead of relying on undocumented MatchAny(any=[])
  semantics; updated the empty-list unit test accordingly.
- access_filter: make the uid_owner/owner share-owner extraction explicit
  ("absent, not empty") to avoid skipping on a falsy-but-present field.
- access_filter: add an operator note that pre-owner_id points need a re-index
  to surface to share recipients (ACL search is a no-op for legacy data).
- verification/webdav: lock the file_accessible_by_id(scope="") contract with a
  targeted multi-user test (owner + recipient True, non-recipient False).
- viz_routes: comment that verify-on-read eviction runs inline by design (no
  lifespan task group available on the Starlette route).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/viz_routes.py

@@ -234,6 +234,12 @@ async def vector_visualization_search(request: Request) -> JSONResponse:
             # exactly as the nc_semantic_search tool path does. Skipping this
             # would let the viz surface stale titles/excerpts from another
             # user's index after a share is revoked.
+            # Eviction of dropped (e.g. revoked-share) points runs INLINE here
+            # by design: this is a Starlette route with no access to the
+            # FastMCP lifespan-owned ``eviction_task_group`` that the
+            # nc_semantic_search tool path passes for fire-and-forget eviction.
+            # The visualization is an interactive, low-QPS endpoint, so blocking
+            # briefly on the Qdrant delete is acceptable.
             with trace_operation("vector_viz.verify_on_read"):
                 verified_results, _dropped = await verify_search_results(
                     nc_client, all_results