fix(vector-sync): address round-4 review — processor test, partial eviction

- tests: cover the process_document consent gate (drops an admin-disabled
  index task with record_ingest_dropped("admin_disabled"); allows approved)
- scanner: _consent_backstop_done is now an insertion-ordered dict and evicts
  the oldest entries to half capacity on overflow, so a bound hit re-fires the
  backstop for only the oldest markers instead of the whole fleet at once
- semantic: reword the short-circuit log (consent, not installation)
- capabilities: comment why move_to_end is needed after an expired-key update
- test: assert the global purge delete-filter is owner-agnostic (doc_type only);
  fix a pre-existing ty error on UnexpectedResponse(headers=None) in the file

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/capabilities.py

@@ -94,6 +94,8 @@ async def allowed_doc_types(
 
     result = _parse_enabled_doc_types(payload)
     _cache[user_id] = (now, result)
+    # New key: __setitem__ already appends (no-op). Existing expired key: the
+    # update keeps its old position, so move it to the end to preserve LRU order.
     _cache.move_to_end(user_id)
     while len(_cache) > _CACHE_MAXSIZE:
         _cache.popitem(last=False)  # evict least-recently-used