sprint2+3: remaining services visibility filter + search provider permission-aware + dashboard route

app/plugins/builtins/unified_search/routes.py

@@ -51,17 +51,20 @@ async def search(
     """Perform hybrid search with KI query understanding."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    is_system_admin = current_user.get("is_system_admin", False)
 
     # KI query understanding
     query_analysis = await llm_analyze_query(req.query, db=db, tenant_id=tenant_id)
 
-    # Hybrid search
+    # Hybrid search with visibility filtering
     results = await hybrid_search(
         db=db,
         query_analysis=query_analysis,
         tenant_id=tenant_id,
         entity_types=req.entity_types,
         limit=req.limit,
+        user_id=user_id,
+        is_system_admin=is_system_admin,
     )
 
     # Resolve user permissions for field-level RBAC