test(vector): close generate()/drop-counter test gaps + https mock URLs (#893)

Round-2 review on PR #893:
- Add test_generate_retries_on_connection_error (generate() shares the transient
  retry; guards the decorator against accidental removal).
- Add test_process_document_records_drop_on_exhausted_retries: drives
  process_document to retry-exhaustion and asserts record_ingest_dropped is
  called once with the classified reason (processor-level coverage, not just the
  _drop_reason unit).
- Note in _drop_reason that a multi-failure group is labelled by its first leaf
  (best-effort, no "mixed" bucket).

SonarCloud: the quality gate was failing on new_security_hotspots_reviewed
(S5332 "use https") from http:// URLs in the test _req() helpers — switched to
https:// (mirrors commit 98c9d58e).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_processor_drop_reason.py

@@ -13,7 +13,7 @@ from nextcloud_mcp_server.vector import processor
 
 
 def _req() -> httpx.Request:
-    return httpx.Request("POST", "http://gw/v1/embeddings")
+    return httpx.Request("POST", "https://gw/v1/embeddings")
 
 
 @pytest.mark.unit
@@ -79,3 +79,33 @@ def test_qdrant_namespace_classified():
 @pytest.mark.unit
 def test_unknown_error_falls_back_to_other():
     assert processor._drop_reason(ValueError("nope")) == "other"
+
+
+@pytest.mark.unit
+async def test_process_document_records_drop_on_exhausted_retries(mocker):
+    """Exhausting retries in process_document increments the drop counter with
+    the classified reason (and re-raises so the outer handler counts the error)."""
+    from nextcloud_mcp_server.vector.scanner import DocumentTask
+
+    doc_task = DocumentTask(
+        user_id="alice",
+        doc_id="42",
+        doc_type="note",
+        operation="index",
+        modified_at=0,
+    )
+
+    mocker.patch.object(
+        processor,
+        "get_qdrant_client",
+        mocker.AsyncMock(return_value=mocker.MagicMock()),
+    )
+    mocker.patch.object(
+        processor, "_index_document", side_effect=httpx.ConnectError("refused")
+    )
+    rec = mocker.patch.object(processor, "record_ingest_dropped")
+
+    with pytest.raises(httpx.ConnectError):
+        await processor.process_document(doc_task, mocker.MagicMock(), max_retries=1)
+
+    rec.assert_called_once_with("connection")