sprint2+3: remaining services visibility filter + search provider permission-aware + dashboard route

app/plugins/builtins/unified_search/search_engine.py

@@ -68,11 +68,15 @@ async def hybrid_search(
     tenant_id: uuid.UUID,
     entity_types: list[str] | None = None,
     limit: int = 20,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
 ) -> list[dict[str, Any]]:
     """Perform hybrid search across all entity types.
 
     For each entity: FTS search + vector search + RRF fusion.
     Merge all results, sort by fused score, return top limit.
+
+    Passes user_id and is_system_admin to each provider for visibility filtering.
     """
     registry = get_search_registry()
     all_entity_types = entity_types or registry.get_entity_types()
@@ -108,13 +112,13 @@ async def hybrid_search(
         vec_results: list[dict[str, Any]] = []
 
         try:
-            fts_results = await provider.search_fts(db, tsquery, tenant_id, fetch_limit)
+            fts_results = await provider.search_fts(db, tsquery, tenant_id, fetch_limit, user_id=user_id, is_system_admin=is_system_admin)
         except Exception:
             logger.exception("FTS search failed for %s", entity_type)
 
         if query_embedding:
             try:
-                vec_results = await provider.search_vector(db, query_embedding, tenant_id, fetch_limit)
+                vec_results = await provider.search_vector(db, query_embedding, tenant_id, fetch_limit, user_id=user_id, is_system_admin=is_system_admin)
             except Exception:
                 logger.exception("Vector search failed for %s", entity_type)