fix(vector-sync): address round-5 review — partial-failure signal, markers

- purge route: include a "failed" key in the 200 body listing requested doc
  types that were not purged, so Astrolabe knows consent isn't yet enforced
  for them (scanner backstop still catches up)
- tests: add @pytest.mark.unit / module-level pytestmark to the new test
  modules so they run under `pytest -m unit`; add a partial-failure route test
- capabilities: comment why the cache is keyed per-user despite a global value
- semantic/scanner: doc/comment clarifications (sorted-order, eviction timing)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/server/semantic.py

@@ -64,10 +64,12 @@ def _consent_narrowed_doc_types(
 
     Caller has already established ``allowed is not None`` (a concrete allow-set;
     ``None`` means "no restriction" and is handled by skipping this call). When
-    no explicit ``doc_types`` are requested, restrict to the full allow-set;
-    otherwise intersect (preserving the caller's order). An empty result means
-    nothing the caller asked for is admin-approved — the caller short-circuits
-    to an empty response rather than falling through to an all-types search.
+    no explicit ``doc_types`` are requested, restrict to the full allow-set
+    (returned ``sorted`` for determinism only — order is a filter, not a ranking
+    hint); otherwise intersect (preserving the caller's order). An empty result
+    means nothing the caller asked for is admin-approved — the caller
+    short-circuits to an empty response rather than falling through to an
+    all-types search.
     """
     if doc_types is None:
         return sorted(allowed)