feat(E): Unified Search — 24 Tasks complete

- SPIKE-E: FTS+Vector+Permission benchmark on 10k records (all <30ms)
- E-PROV: supports_fts/vector/rag/graph capability flags on all providers
- E-FTS/VEC: All 11 providers refactored to BaseSearchProvider with permission filtering
- E-PERM: Over-fetch strategy for vector+permission (15x faster than ANY() filter)
- E-FUSE: rrf_fusion_multi() for N-way RRF over FTS+Vector+RAG+Graph
- E-LLM: Query understanding cleaned up to use central llm_complete()
- E-CHUNK: Document chunking module + document_chunks table with HNSW index
- E-EMB: Chunk embedding ARQ jobs (index_file_chunks, reindex_chunks)
- E-RAG: RAG retrieval via FileSearchProvider.search_rag()
- E-GRAPH: GraphRAG BFS traversal via GraphRAGSearchProvider.search_graph()
- E-IX-EVT: Auto-indexing via outbox events + delete/cleanup handlers
- E-IX-RE: Batch reindex with progress tracking + reindex_all job
- E-DATA-LIFE: Lifecycle module (remove/rebuild/restore/correct) + API endpoints
- E-K-MEM: AgentMemorySearchProvider
- E-P-AI: AIChatSearchProvider
- E-P-WF: WorkflowSearchProvider
- E-P-COMM: ConversationSearchProvider verified (already on BaseSearchProvider)
- E-API: Filter params (date_from/to, tags, sort) + /facets endpoint
- E-TOOL: unified_search AI tool registered in ToolRegistry
- E-MCP: Search tool in MCP server with normal RBAC/tenant checks
- E-UI-CMD: CommandPalette (Cmd+K) with debounced search + recent searches
- E-UI-FAC: SearchFacets, SearchResultCard, SavedSearches components
- E-TEST: 40 new tests in test_unified_search_phase_e.py (105 total green)
- E-DOC: api-documentation.md, plugin-development-guide.md, test-strategy.md updated

105 tests passing, TypeScript clean.

app/plugins/builtins/mcp_server/tool_definitions.py

@@ -47,6 +47,22 @@ TOOL_DEFINITIONS: list[McpToolDefinition] = [
             McpToolParameter(name="body", type="object", description="Request body für POST/PATCH (JSON Objekt)", required=False),
         ],
     ),
+    McpToolDefinition(
+        name="search",
+        description=(
+            "Durchsuche alle CRM-Daten (Kontakte, Firmen, Mails, Dateien, Kalender, Tasks) "
+            "mit Hybrid-Suche (Volltext + semantisch). "
+            "Liefert kompakte Ergebnisse mit entity_type, title, snippet und score. "
+            "Die Suche respektiert die Berechtigungen des aufrufenden Benutzers."
+        ),
+        category="search",
+        required_permission="search:read",
+        parameters=[
+            McpToolParameter(name="query", type="string", description="Suchanfrage, z.B. 'Max Mustermann' oder 'Angebot 2026'", required=True),
+            McpToolParameter(name="entity_types", type="array", description="Optional: Nur diese Entity-Typen durchsuchen (contact, company, mail, file, event, task, ...)", required=False),
+            McpToolParameter(name="limit", type="integer", description="Maximale Anzahl Ergebnisse (Standard: 10)", required=False, default=10),
+        ],
+    ),
 ]
 
 
@@ -119,8 +135,73 @@ async def _handler_call_crm_api(db: AsyncSession, arguments: dict[str, Any], con
         return {"error": str(e)}
 
 
+# ─── Search Tool Handler ──────────────────────────────────────────────────
+
+
+async def _handler_search(db: AsyncSession, arguments: dict[str, Any], context: dict[str, Any]) -> dict[str, Any]:
+    """Execute a unified search on behalf of the MCP client.
+
+    Uses the MCP session's user context (tenant_id, user_id) so that
+    visibility filtering and RBAC are respected. MCP gets no special rights.
+    """
+    query = (arguments.get("query") or "").strip()
+    if not query:
+        return {"error": "query is required"}
+
+    entity_types = arguments.get("entity_types")
+    if isinstance(entity_types, str):
+        entity_types = [t.strip() for t in entity_types.split(",") if t.strip()]
+    limit = int(arguments.get("limit", 10) or 10)
+    limit = max(1, min(limit, 50))
+
+    tenant_id = context.get("tenant_id")
+    user_id = context.get("user_id")
+    is_system_admin = bool(context.get("is_system_admin", False))
+
+    if not tenant_id:
+        return {"error": "missing tenant context"}
+
+    try:
+        tenant_uuid = uuid.UUID(str(tenant_id))
+        user_uuid = uuid.UUID(str(user_id)) if user_id else None
+    except (ValueError, TypeError):
+        return {"error": "invalid tenant/user context"}
+
+    try:
+        from app.plugins.builtins.unified_search.query_understanding import llm_analyze_query
+        from app.plugins.builtins.unified_search.search_engine import hybrid_search
+
+        query_analysis = await llm_analyze_query(query, db=db, tenant_id=tenant_uuid)
+        results = await hybrid_search(
+            db=db,
+            query_analysis=query_analysis,
+            tenant_id=tenant_uuid,
+            entity_types=entity_types,
+            limit=limit,
+            user_id=user_uuid,
+            is_system_admin=is_system_admin,
+        )
+    except Exception as e:
+        logger.exception("MCP search failed")
+        return {"error": str(e)}
+
+    compact = [
+        {
+            "entity_type": r.get("entity_type", ""),
+            "entity_id": r.get("entity_id", ""),
+            "title": r.get("title", ""),
+            "snippet": (r.get("snippet", "") or "")[:200],
+            "score": round(float(r.get("score", 0.0)), 4),
+        }
+        for r in results
+    ]
+
+    return {"count": len(compact), "results": compact}
+
+
 # ─── Handler Registry ─────────────────────────────────────────────────────
 
 TOOL_HANDLERS: dict[str, Any] = {
     "call_crm_api": _handler_call_crm_api,
+    "search": _handler_search,
 }