fix(vector-sync): address round-4 review — processor test, partial eviction

- tests: cover the process_document consent gate (drops an admin-disabled
  index task with record_ingest_dropped("admin_disabled"); allows approved)
- scanner: _consent_backstop_done is now an insertion-ordered dict and evicts
  the oldest entries to half capacity on overflow, so a bound hit re-fires the
  backstop for only the oldest markers instead of the whole fleet at once
- semantic: reword the short-circuit log (consent, not installation)
- capabilities: comment why move_to_end is needed after an expired-key update
- test: assert the global purge delete-filter is owner-agnostic (doc_type only);
  fix a pre-existing ty error on UnexpectedResponse(headers=None) in the file

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/vector/test_purge.py

@@ -53,6 +53,19 @@ async def test_purges_each_doc_type_and_reports_counts(monkeypatch):
     assert client.delete.await_count == 2
 
 
+async def test_purge_is_owner_agnostic_global(monkeypatch):
+    # The admin disable is global, so the delete filter must match by doc_type
+    # ONLY — no owner_id/user_id condition that would scope it to one user.
+    client = _patch_qdrant(monkeypatch, counts={"file": 1})
+
+    await purge_doc_types(["file"])
+
+    flt = client.delete.await_args.kwargs["points_selector"]
+    keys = [c.key for c in flt.must]
+    assert keys == ["doc_type"]
+    assert flt.must[0].match.value == "file"
+
+
 async def test_dedupes_doc_types(monkeypatch):
     client = _patch_qdrant(monkeypatch, counts={"file": 2})