fix(strix): include search authorization context in PR scans

[seonghobae]

Problem

ContextualWisdomLab/naruon#1210 current head bccd1b1e6a722fa286e92f63fc2571b296f5388f failed central Strix run 30684197947 with four findings after the report explicitly limited itself to one frontend component and did not verify backend validation. Static current-head triage showed:

• relationship reads require signed-session AuthContext and SQL user_id plus organization_id filters
• capture-source resolves the email with Email.owner_filters before reading or writing
• state-changing BFF requests reject cross-site Origin/Referer and use a Secure, HttpOnly, SameSite=Lax session cookie
• the AI answer is a React text child, not an HTML sink
• sender addresses remain on the authenticated owner-scoped surface

The central context selector already supplies backend auth context for selected email frontend components, but it does not recognize frontend/src/components/SearchLayout.tsx or provide the ontology/search/BFF/session files needed to assess this path.

Acceptance criteria

• Map SearchLayout and the search route shell to a bounded cross-layer search/auth context.
• Include ontology/search authorization, owner-filter model, BFF same-origin guard, session-cookie, and API-client context without widening findings beyond changed files.
• Preserve trusted-base context for unchanged files and PR-head blobs for files changed in the same PR.
• Add a functional regression proving the expected context is present and unrelated files remain excluded.
• Pass focused/full Strix gate tests, shellcheck, actionlint, and diff hygiene.
• After merge, rerun exact-head Strix for 🎨 Palette: [UX 개선] 검색 결과 빈 화면 및 로딩 상태 시각적 피드백 강화 naruon#1210 and verify the metadata-only aggregate recovers only if the current-head Strix gate succeeds.

Agent: Codex
Started: 2026-08-01T14:00:00+09:00
Phase: Ops