feat(acl): unify the retrieval scopes; mark shared rows in Knowledge browse

Closes #2092 and the Knowledge-browse provenance gap.

The two halves of a hybrid search disagreed: the keyword half honoured shares
while the semantic half was pinned to NoteEmbedding.user_id, so a shared record
was findable by wording and invisible by meaning — the case a semantic search
exists to serve. semantic_search_notes now scopes on Note via a `scope`
parameter, and each of its five callers declares which kind of act it is:

  mcp/tools/search.py     read    the agent asked
  routes/search.py        read    the user typed it
  knowledge.py (semantic) read    matches the keyword half beside it
  plugin_context.py       browse  nobody asked; never a one-to-one share
  dedup.py                own     a verdict that blocks a write must not hinge
                                  on another person's notes

That last one is the reason this isn't a single global widening: the dedup gate
returns "update the existing one instead", so matching a stranger's record would
refuse a legitimate create and point at something the caller can't edit. Scope
defaults to "own" so a caller that forgets is wrong in the safe direction, and an
unknown scope raises rather than falling back — a typo there would be a
data-exposure bug.

Auto-inject keeps the browse scope, which still admits a collaborator's note via
a shared project. Its menu line is the only provenance an agent sees, so a
foreign hit now reads: #12 "Title" (0.71) - shared by alex, treat as a
suggestion. MCP and REST search results carry shared/owner too.

Knowledge browse: the feed hydrates cards from /api/knowledge/batch rather than
the list route, so both paths label rows now, and KnowledgeView shows "by
<owner>" on records the viewer doesn't own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLwAaV4DQEmVyn496HnEvt

src/scribe/services/embeddings.py

@@ -19,6 +19,7 @@ from sqlalchemy import delete, select
 from scribe.models import async_session
 from scribe.models.embedding import NoteEmbedding
 from scribe.models.note import Note
+from scribe.services.access import notes_visibility_clause
 
 logger = logging.getLogger(__name__)
 
@@ -114,12 +115,21 @@ async def semantic_search_notes(
     project_id: int | None = None,
     is_task: bool | None = None,
     orphan_only: bool = False,
+    scope: str = "own",
 ) -> list[tuple[float, Note]]:
     """Return up to *limit* (score, note) pairs most relevant to *query*.
 
     Scores are cosine similarities in [-1, 1]; only notes at or above
     *threshold* are returned, sorted highest-first.
 
+    `scope` ("own" | "browse" | "read", see access.notes_visibility_clause)
+    decides how far this may see. It exists because this one function serves
+    three different kinds of act: an explicit search, which should reach
+    everything the caller may read; passive auto-injection, which must not pull
+    an unrequested record into their context; and the near-duplicate gate, whose
+    verdict must not depend on other people's notes at all. Defaults to "own" so
+    a caller that forgets is wrong in the safe direction.
+
     Ranking and the top-k cut happen in Postgres via pgvector's cosine-distance
     operator (`<=>`, exposed as ``Vector.cosine_distance``) backed by the HNSW
     index from migration 0067 — so this is an indexed ``ORDER BY ... LIMIT k``
@@ -145,11 +155,17 @@ async def semantic_search_notes(
 
     try:
         async with async_session() as session:
+            # Scope on Note, not NoteEmbedding.user_id: the embedding row belongs
+            # to the note's owner, so filtering it would pin every scope to "own"
+            # and leave shared records unreachable by meaning.
             stmt = (
                 select(Note, distance.label("distance"))
                 .select_from(NoteEmbedding)
                 .join(Note, NoteEmbedding.note_id == Note.id)
-                .where(NoteEmbedding.user_id == user_id, Note.deleted_at.is_(None))
+                .where(
+                    notes_visibility_clause(user_id, scope),
+                    Note.deleted_at.is_(None),
+                )
             )
             if orphan_only:
                 stmt = stmt.where(Note.project_id.is_(None))