fix(search): address PR #834 re-review (403/404 coverage + docs)

Resolve the blocking + important findings from the claude bot's re-review:

- test (blocking): pin the file verifier's fail-open contract for definitive
  403/404 on the tag REPORT, not just transient 503/429. A disabled systemtags
  endpoint commonly 403s; unlike the per-access verifiers (where 403/404 = drop),
  the batch file verifier must keep all results since the whole set hinges on one
  REPORT. Adds _http_error(403)/_http_error(404) to
  test_verify_files_tag_fetch_failure_keeps_all and documents the asymmetry.
- docs (important): migration caveat — if vector-index was created as
  user_visible=False (manual occ tag:add, or pre-release), an owner's tag won't
  surface in a recipient's REPORT and shared-file results are silently dropped
  after upgrade. Note that the MCP server's get_or_create_tag defaults to
  user_visible=True, and how to verify/fix an existing tag.
- docs (important): note the file verifier's latency scales with both the
  Depth:infinity folder expansion and the EXCLUDED_TAGS lookup (~2 WebDAV calls
  per excluded tag, fanned out under one slot); suggest lowering
  VERIFICATION_CONCURRENCY for large excluded-tag lists / deeply tagged trees.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/search/test_verification.py

@@ -529,10 +529,24 @@ async def test_verify_files_excluded_path_drops(mocker):
 
 @pytest.mark.unit
 async def test_verify_files_tag_fetch_failure_keeps_all(mocker):
-    """If the tag REPORT itself fails (HTTP or otherwise), keep every file
-    result (fail-open) — never silently shrink results on a backend blip."""
+    """If the tag REPORT itself fails, keep every file result (fail-open) —
+    never silently shrink results on a backend blip.
+
+    Unlike the per-access verifiers (notes/deck/news), where a definitive
+    403/404 is the DROP signal, the file verifier fails open on *every* HTTP
+    error — including 403/404. The whole result set hinges on one batch REPORT,
+    so a disabled systemtags endpoint (commonly 403) must not nuke all file
+    results; the next query re-verifies. 403 and 404 are pinned here alongside
+    the transient 503/429 to lock that contract against regression.
+    """
     _patch_excluded(mocker)
-    for exc in (_http_error(503), _http_error(429), RuntimeError("dav blew up")):
+    for exc in (
+        _http_error(403),
+        _http_error(404),
+        _http_error(503),
+        _http_error(429),
+        RuntimeError("dav blew up"),
+    ):
         client = _file_client(mocker, find_side_effect=exc)
         result = await _verify_files(
             client,