feat(acl): unify the retrieval scopes; mark shared rows in Knowledge browse

Closes #2092 and the Knowledge-browse provenance gap.

The two halves of a hybrid search disagreed: the keyword half honoured shares
while the semantic half was pinned to NoteEmbedding.user_id, so a shared record
was findable by wording and invisible by meaning — the case a semantic search
exists to serve. semantic_search_notes now scopes on Note via a `scope`
parameter, and each of its five callers declares which kind of act it is:

  mcp/tools/search.py     read    the agent asked
  routes/search.py        read    the user typed it
  knowledge.py (semantic) read    matches the keyword half beside it
  plugin_context.py       browse  nobody asked; never a one-to-one share
  dedup.py                own     a verdict that blocks a write must not hinge
                                  on another person's notes

That last one is the reason this isn't a single global widening: the dedup gate
returns "update the existing one instead", so matching a stranger's record would
refuse a legitimate create and point at something the caller can't edit. Scope
defaults to "own" so a caller that forgets is wrong in the safe direction, and an
unknown scope raises rather than falling back — a typo there would be a
data-exposure bug.

Auto-inject keeps the browse scope, which still admits a collaborator's note via
a shared project. Its menu line is the only provenance an agent sees, so a
foreign hit now reads: #12 "Title" (0.71) - shared by alex, treat as a
suggestion. MCP and REST search results carry shared/owner too.

Knowledge browse: the feed hydrates cards from /api/knowledge/batch rather than
the list route, so both paths label rows now, and KnowledgeView shows "by
<owner>" on records the viewer doesn't own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLwAaV4DQEmVyn496HnEvt

src/scribe/routes/search.py

@@ -3,6 +3,7 @@ import time
 from quart import Blueprint, jsonify, request
 
 from scribe.auth import login_required, get_current_user_id
+from scribe.services.access import owner_names_for
 from scribe.services.embeddings import semantic_search_notes
 from scribe.services.retrieval_telemetry import record_retrieval
 
@@ -36,7 +37,9 @@ async def search_route():
 
     t0 = time.perf_counter()
     results = await semantic_search_notes(
-        uid, q, limit=limit, is_task=is_task, threshold=_REST_SEARCH_THRESHOLD
+        uid, q, limit=limit, is_task=is_task, threshold=_REST_SEARCH_THRESHOLD,
+        # The user typed this, so it reaches everything they may read.
+        scope="read",
     )
     record_retrieval(
         user_id=uid, source="rest_search", query=q,
@@ -44,6 +47,9 @@ async def search_route():
         project_id=None, is_task=is_task, results=results,
         duration_ms=(time.perf_counter() - t0) * 1000.0,
     )
+    owners = await owner_names_for(
+        {int(note.user_id) for _s, note in results if note.user_id != uid}
+    )
     return jsonify({
         "results": [
             {
@@ -53,6 +59,10 @@ async def search_route():
                 "is_task": note.is_task,
                 "tags": note.tags or [],
                 "similarity": score,
+                **(
+                    {"shared": True, "owner": owners.get(int(note.user_id))}
+                    if note.user_id != uid else {}
+                ),
             }
             for score, note in results  # semantic_search_notes returns list[tuple[float, Note]]
         ],