feat: add opt-in MCP decomposition hook points (design §10)

Adds the seven §10.2 hook-point modules + five env vars so Astrolabe Cloud can
offload document processing to the external document-processor / embedding
gateway. Purely additive: with every setting unset the server behaves exactly
as today, so self-hosters are unaffected (Deck #92).

Hook points (all default to current monolith behavior):
- config: EMBEDDING_PROVIDER, INGEST_MODE, STATUS_BACKEND,
  COLLECTION_METADATA_SOURCE, FACT_EVENT_EMITTER (+ supporting settings),
  validated in Settings.__post_init__ (fail-fast STATUS_BACKEND=local with
  INGEST_MODE=external); shared canonical.py.
- vector/payload_keys.py + acl_hash.py: cross-impl NAMESPACE/point_id (§2.2)
  and BLAKE2b-128 ACL hash (§11), pinned by fixtures shared with the
  document-processor repo.
- embedding/gateway_client.py: OpenAI-compatible GatewayProvider authenticating
  via M2M OIDC client-credentials (separate realm); manual-only registry entry.
- vector/collection_metadata.py: sentinel-point / API metadata source with env
  fallback.
- vector/queue/: hexagonal ingest producer ports + memory/NATS adapters
  (Postgres seam); INGEST_MODE=external publishes mcp.ingest.requested.{tenant}
  instead of the in-memory stream and skips the in-process processor pool. The
  lifespan becomes a composition root across both deployment branches.
- vector/queue/status.py: STATUS_BACKEND=bus subscriber feeding a StatusStore
  the vector-sync status endpoint reads.
- admin/payload_backfill.py: POST /api/v1/admin/payload-backfill (admin scope);
  processor writes the new payload keys; query-side ACL pre-filter gated behind
  ACL_PREFILTER_ENABLED (default off).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/providers/test_gateway_provider.py

@@ -0,0 +1,117 @@
+"""Gateway provider registration + M2M OIDC auth (design §10.2).
+
+The gateway is manual-only: selected by EMBEDDING_PROVIDER=gateway and never by
+the autodetect chain. Auth is the gateway's own M2M OIDC realm (parallel to the
+tenant realm); creds are all-or-nothing.
+"""
+
+import time
+
+import httpx
+import pytest
+
+from nextcloud_mcp_server.config import Settings
+from nextcloud_mcp_server.embedding.gateway_client import (
+    GatewayProvider,
+    GatewayTokenProvider,
+)
+from nextcloud_mcp_server.providers.registry import ProviderRegistry, reset_provider
+from nextcloud_mcp_server.providers.simple import SimpleProvider
+
+
+def _patch_settings(monkeypatch, settings):
+    monkeypatch.setattr(
+        "nextcloud_mcp_server.providers.registry.get_settings", lambda: settings
+    )
+    reset_provider()
+
+
+def test_gateway_selected_unauthenticated(monkeypatch):
+    settings = Settings(
+        embedding_provider="gateway",
+        embedding_gateway_url="http://gateway:8083",
+        embedding_gateway_model="mistral-embed",
+    )
+    _patch_settings(monkeypatch, settings)
+    provider = ProviderRegistry.create_provider()
+    assert isinstance(provider, GatewayProvider)
+    assert provider.embedding_model == "mistral-embed"
+    assert provider.supports_embeddings is True
+    assert provider.supports_generation is False
+    assert provider._token_provider is None  # unauthenticated
+
+
+def test_gateway_selected_with_m2m_oidc(monkeypatch):
+    settings = Settings(
+        embedding_provider="gateway",
+        embedding_gateway_url="http://gateway:8083",
+        embedding_gateway_token_url="https://idp.example/oauth2/token",
+        embedding_gateway_client_id="mcp-server",
+        embedding_gateway_client_secret="shh",
+        embedding_gateway_scope="astrolabe-embedding-gateway/embed",
+    )
+    _patch_settings(monkeypatch, settings)
+    provider = ProviderRegistry.create_provider()
+    assert isinstance(provider, GatewayProvider)
+    assert isinstance(provider._token_provider, GatewayTokenProvider)
+
+
+def test_partial_m2m_creds_rejected():
+    with pytest.raises(ValueError, match="must be set together"):
+        Settings(
+            embedding_provider="gateway",
+            embedding_gateway_url="http://gateway:8083",
+            embedding_gateway_client_id="mcp-server",  # missing token_url/secret
+        )
+
+
+def test_autodetect_default_does_not_pick_gateway(monkeypatch):
+    settings = Settings()
+    _patch_settings(monkeypatch, settings)
+    assert isinstance(ProviderRegistry.create_provider(), SimpleProvider)
+
+
+def test_openai_creds_do_not_trigger_gateway(monkeypatch):
+    settings = Settings(openai_api_key="sk-test")
+    _patch_settings(monkeypatch, settings)
+    assert not isinstance(ProviderRegistry.create_provider(), GatewayProvider)
+
+
+async def test_token_provider_caches_and_refreshes(monkeypatch):
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        assert request.headers["Authorization"].startswith("Basic ")
+        body = dict(httpx.QueryParams(request.content.decode()))
+        assert body["grant_type"] == "client_credentials"
+        assert body["scope"] == "embed"
+        return httpx.Response(
+            200, json={"access_token": f"tok{calls['n']}", "expires_in": 3600}
+        )
+
+    transport = httpx.MockTransport(handler)
+    orig_async_client = httpx.AsyncClient
+
+    def _client(*args, **kwargs):
+        kwargs["transport"] = transport
+        return orig_async_client(*args, **kwargs)
+
+    monkeypatch.setattr(httpx, "AsyncClient", _client)
+
+    tp = GatewayTokenProvider(
+        token_url="https://idp.example/oauth2/token",
+        client_id="cid",
+        client_secret="sec",
+        scope="embed",
+    )
+    t1 = await tp.get_token()
+    t2 = await tp.get_token()  # cached → no new HTTP call
+    assert t1 == t2 == "tok1"
+    assert calls["n"] == 1
+
+    # Expire the cache → next call refreshes.
+    tp._cache = (tp._cache[0], time.time() - 1)
+    t3 = await tp.get_token()
+    assert t3 == "tok2"
+    assert calls["n"] == 2