feat(acl): unify the retrieval scopes; mark shared rows in Knowledge browse

Closes #2092 and the Knowledge-browse provenance gap.

The two halves of a hybrid search disagreed: the keyword half honoured shares
while the semantic half was pinned to NoteEmbedding.user_id, so a shared record
was findable by wording and invisible by meaning — the case a semantic search
exists to serve. semantic_search_notes now scopes on Note via a `scope`
parameter, and each of its five callers declares which kind of act it is:

  mcp/tools/search.py     read    the agent asked
  routes/search.py        read    the user typed it
  knowledge.py (semantic) read    matches the keyword half beside it
  plugin_context.py       browse  nobody asked; never a one-to-one share
  dedup.py                own     a verdict that blocks a write must not hinge
                                  on another person's notes

That last one is the reason this isn't a single global widening: the dedup gate
returns "update the existing one instead", so matching a stranger's record would
refuse a legitimate create and point at something the caller can't edit. Scope
defaults to "own" so a caller that forgets is wrong in the safe direction, and an
unknown scope raises rather than falling back — a typo there would be a
data-exposure bug.

Auto-inject keeps the browse scope, which still admits a collaborator's note via
a shared project. Its menu line is the only provenance an agent sees, so a
foreign hit now reads: #12 "Title" (0.71) - shared by alex, treat as a
suggestion. MCP and REST search results carry shared/owner too.

Knowledge browse: the feed hydrates cards from /api/knowledge/batch rather than
the list route, so both paths label rows now, and KnowledgeView shows "by
<owner>" on records the viewer doesn't own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLwAaV4DQEmVyn496HnEvt

frontend/src/views/KnowledgeView.vue

@@ -27,6 +27,10 @@ interface KnowledgeItem {
   project_id: number | null;
   created_at: string;
   updated_at: string;
+  // Set only when another user owns this record — their suggestion, not one of
+  // yours. Absent means it's yours.
+  shared?: boolean;
+  owner?: string | null;
   // Task-specific
   status?: string;
   priority?: string;
@@ -437,6 +441,11 @@ onUnmounted(() => {
               <div class="k-card-tags">
                 <span v-for="tag in item.tags.slice(0, 3)" :key="tag" class="tag-pill">{{ tag }}</span>
               </div>
+              <span
+                v-if="item.shared"
+                class="shared-tag"
+                :title="`Shared by ${item.owner ?? 'another user'} — their record, not yours`"
+              >by {{ item.owner ?? "another user" }}</span>
               <span class="k-card-date">{{ formatDate(item.updated_at) }}</span>
             </div>
           </div>
@@ -839,6 +848,16 @@ onUnmounted(() => {
   color: var(--color-muted);
 }
 .k-card-date { font-size: 0.72rem; color: var(--color-text-secondary); white-space: nowrap; opacity: 0.7; }
+/* Only rendered for a record another user owns, so an unmarked card is
+   unambiguously the viewer's own. */
+.shared-tag {
+  font-size: 0.68rem;
+  padding: 0.08rem 0.35rem;
+  border-radius: 4px;
+  white-space: nowrap;
+  background: color-mix(in srgb, var(--color-text-secondary) 15%, transparent);
+  color: var(--color-text-secondary);
+}
 
 /* ── Task card ──────────────────────────────────────────── */
 .k-card-task {