fix(vector-sync): address round-4 review — processor test, partial eviction

- tests: cover the process_document consent gate (drops an admin-disabled
  index task with record_ingest_dropped("admin_disabled"); allows approved)
- scanner: _consent_backstop_done is now an insertion-ordered dict and evicts
  the oldest entries to half capacity on overflow, so a bound hit re-fires the
  backstop for only the oldest markers instead of the whole fleet at once
- semantic: reword the short-circuit log (consent, not installation)
- capabilities: comment why move_to_end is needed after an expired-key update
- test: assert the global purge delete-filter is owner-agnostic (doc_type only);
  fix a pre-existing ty error on UnexpectedResponse(headers=None) in the file

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/server/semantic.py

@@ -330,7 +330,7 @@ def configure_semantic_tools(mcp: FastMCP):
             if not doc_types:
                 logger.info(
                     "Semantic search short-circuited for user %s: no requested "
-                    "doc_type is both installed and admin-approved",
+                    "doc_type is admin-approved for semantic search",
                     username,
                 )
                 return SemanticSearchResponse(