fix(vector-sync): address round-5 review — partial-failure signal, markers

- purge route: include a "failed" key in the 200 body listing requested doc
  types that were not purged, so Astrolabe knows consent isn't yet enforced
  for them (scanner backstop still catches up)
- tests: add @pytest.mark.unit / module-level pytestmark to the new test
  modules so they run under `pytest -m unit`; add a partial-failure route test
- capabilities: comment why the cache is keyed per-user despite a global value
- semantic/scanner: doc/comment clarifications (sorted-order, eviction timing)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/server/test_semantic_consent_narrowing.py

@@ -9,8 +9,12 @@ caller skipping this helper entirely.
 
 from __future__ import annotations
 
+import pytest
+
 from nextcloud_mcp_server.server.semantic import _consent_narrowed_doc_types
 
+pytestmark = pytest.mark.unit
+
 
 def test_none_request_restricts_to_allow_set():
     # No explicit doc_types -> search exactly the allowed set (sorted).