fix(vector-sync): address round-5 review — partial-failure signal, markers

- purge route: include a "failed" key in the 200 body listing requested doc
  types that were not purged, so Astrolabe knows consent isn't yet enforced
  for them (scanner backstop still catches up)
- tests: add @pytest.mark.unit / module-level pytestmark to the new test
  modules so they run under `pytest -m unit`; add a partial-failure route test
- capabilities: comment why the cache is keyed per-user despite a global value
- semantic/scanner: doc/comment clarifications (sorted-order, eviction timing)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_processor_drop_reason.py

@@ -111,6 +111,7 @@ async def test_process_document_records_drop_on_exhausted_retries(mocker):
     rec.assert_called_once_with("connection")
 
 
+@pytest.mark.unit
 async def test_process_document_drops_admin_disabled_index_task(mocker):
     """A near-real-time index task for an admin-disabled doc_type is dropped
     before indexing, and recorded under the ``admin_disabled`` reason."""
@@ -143,6 +144,7 @@ async def test_process_document_drops_admin_disabled_index_task(mocker):
     rec.assert_called_once_with("admin_disabled")
 
 
+@pytest.mark.unit
 async def test_process_document_allows_when_doc_type_approved(mocker):
     """The consent gate does not drop an index task for an allowed doc_type."""
     from nextcloud_mcp_server.vector.scanner import DocumentTask