fix(vector-sync): address PR review — dict guard, symmetric backstop, metrics

- purge route: 400 (not 500) on a valid-JSON non-object body
- scanner: backstop-purge admin-disabled note/news_item/deck_card points
  (their deletion-tracking lives inside the skipped scan_* fns), mirroring the
  files path; gated on a concrete allow-set so fail-open never deletes
- processor: record_ingest_dropped("admin_disabled") so consent-skipped index
  tasks are observable/alertable
- app.py: list /api/v1/vector-sync/purge in the endpoints log line
- capabilities: drop empty-string doc types; return frozenset throughout
- purge: document the count-before-delete approximation
- tests: non-object body -> 400, ProvisioningRequiredError -> 428, cache TTL
  expiry refetch, and the scanner consent backstop

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/api/vector_sync.py

@@ -65,6 +65,12 @@ async def purge_doc_types_route(request: Request) -> JSONResponse:
             status_code=400,
         )
 
+    if not isinstance(body, dict):
+        return JSONResponse(
+            {"error": "Bad request", "message": "body must be a JSON object"},
+            status_code=400,
+        )
+
     raw = body.get("doc_types")
     if not isinstance(raw, list) or not all(isinstance(d, str) for d in raw):
         return JSONResponse(
@@ -115,7 +121,7 @@ async def purge_doc_types_route(request: Request) -> JSONResponse:
             status_code=428,
         )
     except Exception as e:
-        logger.error("Error purging doc types for user %s: %s", user_id, e)
+        logger.exception("Error purging doc types for user %s", user_id)
         return JSONResponse(
             {
                 "error": "Internal error",