fix: address PR #836 round-3 review (lock-key invariant, single open)

🟡 Document the _doc_queueing_lock ":" delimiter invariant (user_id and the
   controlled doc_type enum are colon-free, so the key is collision-safe; a
   future doc_type with ":" must not be added).
🟡 API pod no longer opens the procrastinate connector twice on startup: add
   ProcrastinateTaskProducer.ensure_schema() (applies the schema on the
   already-open pool) and have both lifespan branches build the producer then
   ensure_schema — one open/close cycle, matching the worker. build_producer now
   returns the concrete producer type.
🟢 Document in ports.py that a long-lived-connection producer may optionally
   provide drain() (lifespan probes via getattr).
🟢 Add a unit test that a non-credential pipeline error propagates (for
   procrastinate's RetryStrategy) and still closes the client via finally.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/vector/queue/ports.py

@@ -52,8 +52,14 @@ class TaskProducer(Protocol):
     async def aclose(self) -> None:
         """Close *this* handle (e.g. a per-user clone when its scanner exits).
 
-        For the memory stream this closes the clone; for the shared bus
-        connection it is a no-op (the connection is owned by the lifespan,
-        which drains it once on shutdown).
+        For the memory stream this closes the clone; for a shared connection it
+        is a no-op (the connection is owned by the lifespan, which tears it down
+        once on shutdown).
         """
         ...
+
+    # Note: this protocol deliberately omits ``drain()``. An implementation that
+    # owns a long-lived shared connection (e.g. ProcrastinateTaskProducer's
+    # connector pool) may additionally provide ``async def drain()`` for the
+    # lifespan to close that pool once on shutdown; the lifespan probes for it
+    # with ``getattr(task_producer, "drain", None)``, so it stays optional.