RAG: actor-scoped visibility enforcement on retrieval

[qiuethan]

Sub-issue of the RAG retrieval epic (#125).

Why

The LLM is not a trust boundary. A user must never retrieve a chunk from a document they cannot read, regardless of how the question is phrased.

Scope

• Retrieval is actor-scoped: every query carries the asking user, and results are filtered by the per-doc grants built in Document visibility: per-doc grants (person/team) + actor-scoped enforcement #74.
• Filtering happens in the query, not after ranking — otherwise top-k is computed over documents the user cannot see and returns fewer results than it should.
• Reuse doc_visible() / doc_grants rather than reimplementing visibility.

Acceptance

• Two users with different grants issue the same query and receive different results.
• A user with no grants receives nothing.
• Tests cover the filter-before-rank behaviour, not just the final result set.

[qiuethan]

Superseded by #176, which now owns actor-scoped retrieval end to end.

Not dropped — merged. Visibility filtering has to happen inside the similarity query rather than after ranking: rank-then-filter computes top-k across documents the actor cannot see and then discards some, so a member with partial access silently gets fewer results than they asked for, and the more restricted they are the emptier their results get. That makes "build the query" and "filter the query" the same piece of work. Split across two issues, whichever shipped first was either wrong or unstartable.

#176's acceptance now carries this issue's requirements, including the filter-before-rank test that a post-filter implementation has to fail, and the rule that no unfiltered route exists — not even behind a flag.

Closing as not planned rather than completed, since the work moved rather than shipped.