fix(vector-sync): address round-7 — only log purge endpoint when enabled

- app.py: move the /api/v1/vector-sync/purge mention out of the unconditional
  management-endpoints log and into the vector_sync_enabled block, so operators
  without Qdrant don't see an endpoint that 404s
- vector_sync route: comment why doc_types isn't whitelisted against
  INDEXED_DOC_TYPES (unknown type = harmless zero-match no-op)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/api/vector_sync.py

@@ -80,6 +80,9 @@ async def purge_doc_types_route(request: Request) -> JSONResponse:
     if not isinstance(raw, list) or not all(isinstance(d, str) for d in raw):
         return _bad_request("doc_types must be a list of strings")
     doc_types = [d for d in raw if d]
+    # No whitelist against INDEXED_DOC_TYPES on purpose: an unknown type yields a
+    # zero-match Qdrant filter (harmless no-op), and the canonical set lives with
+    # the indexer — the route shouldn't need a server update to purge a new type.
     # Bound the batch: there are only a handful of real indexed types, so a huge
     # list is abuse — cap it rather than fan out unbounded count+delete calls.
     if len(doc_types) > _MAX_PURGE_DOC_TYPES:

nextcloud_mcp_server/app.py

@@ -2435,6 +2435,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                     methods=["POST"],
                 )
             )
+            logger.info("Vector-sync admin endpoint enabled: /api/v1/vector-sync/purge")
         # Access and scope management endpoints (ADR-022)
         routes.append(
             Route(
@@ -2457,7 +2458,7 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             "/api/v1/users/{user_id}/app-password, /api/v1/users/{user_id}/access, "
             "/api/v1/users/{user_id}/scopes, /api/v1/scopes, "
             "/api/v1/vector-viz/search, /api/v1/search, /api/v1/apps, "
-            "/api/v1/webhooks, /api/v1/vector-sync/purge, /api/v1/pdf-preview"
+            "/api/v1/webhooks, /api/v1/pdf-preview"
         )
 
     # Note: Metrics endpoint is NOT exposed on main HTTP port for security reasons.