Enforce per-object ACLs on semantic search results

[tomchop]

Summary

• POST /search/semantic fetched candidate objects straight from Arango by id (cls.get(meta["id"])) with zero user/ACL check -- any authenticated caller got back every nearest-neighbor match regardless of what they actually have READ permission on. Harmless while nothing called this endpoint from the product; not fine once an agent (with a restricted service account) starts using it as a tool.
• Filtering has to happen per-candidate, not as an endpoint-level guard: a @global_permission-style decorator only checks a blanket "can this user read anything" flag, not whether this specific object is one they can see. Reuses the same primitive as permission_on_target/permission_on_ids: user.has_permissions(extended_id, Permission.READ) (one ACL-graph traversal per candidate), same not RBAC_ENABLED or user.admin bypass as everywhere else.
• Since ACL filtering happens after the similarity search, overfetches from Chroma (3x) when enforcement is active so dropped candidates don't shrink the result count below what was requested. This is a best-effort cushion, not a guarantee -- documented in the code and in the memory notes for this workstream.

Test plan

• Existing tests/core_tests/chromadb_test.py suite converted from calling semantic_search() directly to going through an authenticated TestClient, since the endpoint now reads httpreq.state.user.
• New test_semantic_search_respects_acls: two entities, ACL granted on only one, confirms the ungranted one never appears in results.
• New test_semantic_search_admin_bypasses_acls: confirms an admin still sees everything regardless of ACLs (matches every other RBAC bypass in the codebase).
• Full unittest suite (schemas, apiv2, core_tests) run locally -- no regressions (10 pre-existing failures are unrelated /opt/yeti/... permission issues in this sandbox).
• ruff check/format --check and ty check clean on touched files.

Companion docker-compose.yaml change (persistent volume for the chromadb path, previously wiped on every container recreate) is in yeti-docker, not this repo.