feat(vector-sync): honor Astrolabe admin consent for searchable sources

Consume the astrolabe.semantic_search capability as the source of truth for
which content sources an admin has approved for semantic search, and enforce
it independently of Astrolabe (this server queries Qdrant directly).

- capabilities.py: cached per-user reader for enabled_doc_types (TTL+LRU,
  fail-open so older Astrolabe / transient OCS errors don't break search)
- semantic search: intersect requested doc_types with the allowed set;
  restrict to the allowed set when none requested; short-circuit when empty
- scanner: skip disabled sources during discovery (files discovery yields
  nothing when disabled, so the existing grace-period reconcile purges them)
- processor: drop near-real-time index tasks for disabled doc_types
  (webhook events bypass the scanner gate); deletes always proceed
- vector/purge.py + POST /api/v1/vector-sync/purge: admin-only global
  delete-by-doc_type, called by Astrolabe when a source is disabled so
  consent is binding on data-at-rest

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/api/__init__.py

@@ -36,6 +36,9 @@ from nextcloud_mcp_server.api.passwords import (
     get_app_password_status,
     provision_app_password,
 )
+from nextcloud_mcp_server.api.vector_sync import (
+    purge_doc_types_route,
+)
 from nextcloud_mcp_server.api.visualization import (
     get_chunk_context,
     get_pdf_preview,
@@ -78,6 +81,8 @@ __all__ = [
     "list_webhooks",
     "create_webhook",
     "delete_webhook",
+    # Vector-sync admin endpoints (from vector_sync.py)
+    "purge_doc_types_route",
     # Visualization endpoints (from visualization.py)
     "unified_search",
     "vector_search",