fix(search): address review feedback on multi-folder path filter

- visualization.py: drop the CSV string-split branch. The Astrolabe PHP
  client sends path_prefixes as a JSON array, so only a list is accepted;
  any other shape is ignored rather than comma-split (which would corrupt
  folder names containing commas).
- viz_routes.py: split the path_prefixes query param on newline (a comma
  is a valid POSIX path char; a newline is not) and pass None instead of
  [""] when the param is absent.
- access_filter.py: widen build_base_filter_conditions' path_prefixes to
  Iterable[str] for consistency with normalize_path_prefixes.
- ADR-027: document the newline delimiter (frontend/viz route) and JSON
  array (PHP->MCP body), and the PHP-side cap on list width.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/viz_routes.py

@@ -148,12 +148,15 @@ async def vector_visualization_search(request: Request) -> JSONResponse:
     doc_types = doc_types_param.split(",") if doc_types_param else None
 
     # ADR-027 Phase 2 path filter (files only); blank ⇒ no filter. Accept a
-    # comma-separated path_prefixes list (multi-folder) plus the legacy single
-    # path_prefix; normalize_path_prefixes drops blanks and de-dupes.
+    # newline-separated path_prefixes list (multi-folder) plus the legacy single
+    # path_prefix; normalize_path_prefixes drops blanks and de-dupes. Newline is
+    # the delimiter because it can't appear in a POSIX path (unlike a comma), so
+    # folder names are never split mid-value.
     path_prefix = request.query_params.get("path_prefix")
+    _raw_prefixes = request.query_params.get("path_prefixes")
     path_prefixes = normalize_path_prefixes(
         path_prefix,
-        (request.query_params.get("path_prefixes") or "").split(","),
+        _raw_prefixes.split("\n") if _raw_prefixes else None,
     )
 
     # Parse ADR-027 modified-date range filter. Accepts RFC 3339 / ISO 8601