feat: add opt-in MCP decomposition hook points (design §10)

Adds the seven §10.2 hook-point modules + five env vars so Astrolabe Cloud can
offload document processing to the external document-processor / embedding
gateway. Purely additive: with every setting unset the server behaves exactly
as today, so self-hosters are unaffected (Deck #92).

Hook points (all default to current monolith behavior):
- config: EMBEDDING_PROVIDER, INGEST_MODE, STATUS_BACKEND,
  COLLECTION_METADATA_SOURCE, FACT_EVENT_EMITTER (+ supporting settings),
  validated in Settings.__post_init__ (fail-fast STATUS_BACKEND=local with
  INGEST_MODE=external); shared canonical.py.
- vector/payload_keys.py + acl_hash.py: cross-impl NAMESPACE/point_id (§2.2)
  and BLAKE2b-128 ACL hash (§11), pinned by fixtures shared with the
  document-processor repo.
- embedding/gateway_client.py: OpenAI-compatible GatewayProvider authenticating
  via M2M OIDC client-credentials (separate realm); manual-only registry entry.
- vector/collection_metadata.py: sentinel-point / API metadata source with env
  fallback.
- vector/queue/: hexagonal ingest producer ports + memory/NATS adapters
  (Postgres seam); INGEST_MODE=external publishes mcp.ingest.requested.{tenant}
  instead of the in-memory stream and skips the in-process processor pool. The
  lifespan becomes a composition root across both deployment branches.
- vector/queue/status.py: STATUS_BACKEND=bus subscriber feeding a StatusStore
  the vector-sync status endpoint reads.
- admin/payload_backfill.py: POST /api/v1/admin/payload-backfill (admin scope);
  processor writes the new payload keys; query-side ACL pre-filter gated behind
  ACL_PREFILTER_ENABLED (default off).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/search/semantic.py

@@ -3,8 +3,9 @@
 import logging
 from typing import Any
 
-from qdrant_client.models import FieldCondition, Filter, MatchValue
+from qdrant_client.models import FieldCondition, Filter, MatchAny, MatchValue
 
+from nextcloud_mcp_server.acl_hash import accessible_hash_set
 from nextcloud_mcp_server.config import get_settings
 from nextcloud_mcp_server.embedding import get_embedding_service
 from nextcloud_mcp_server.observability.metrics import record_qdrant_operation
@@ -13,6 +14,7 @@ from nextcloud_mcp_server.search.algorithms import (
     SearchResult,
     build_search_result_from_point,
 )
+from nextcloud_mcp_server.vector.payload_keys import ACL_HASH
 from nextcloud_mcp_server.vector.placeholder import get_placeholder_filter
 from nextcloud_mcp_server.vector.qdrant_client import get_qdrant_client
 
@@ -112,6 +114,20 @@ class SemanticSearchAlgorithm(SearchAlgorithm):
                 )
             )
 
+        # ACL pre-filter (design §11), opt-in via ACL_PREFILTER_ENABLED and OFF
+        # by default. Additive `must` condition — it can only narrow results,
+        # never broaden them, and verify-on-read remains the correctness
+        # backstop. Only enable after a real acl_hash backfill: a MatchAny on
+        # acl_hash excludes points missing the key (legacy docs), so enabling
+        # it on an un-backfilled collection would silently drop results.
+        if settings.acl_prefilter_enabled:
+            # Groups are not yet threaded into the search signature; user +
+            # public principals are covered. Group support is a follow-up.
+            accessible = accessible_hash_set(user_id)
+            filter_conditions.append(
+                FieldCondition(key=ACL_HASH, match=MatchAny(any=sorted(accessible)))
+            )
+
         # Search Qdrant
         qdrant_client = await get_qdrant_client()
         try: