Backend 0.8.13 — zero-touch Phase 2 + search retrieval fixes

Search follow-ups that make the 0.8.12 work correct and operator-free at scale.

Zero-touch vault filter (#214, #189 Phase 2 follow-up)

The vault_filter_enabled ACL-pushdown no longer needs a manual backfill script or a hand-flipped flag. A vault_backfill worker backfills vault_id onto pre-upgrade pgvector points on startup (idempotent batches; same-instance via a server-side join), and search self-activates the vault path only once it reports ready — until then it transparently uses the source-id path (no under-fetch). The flag now defaults on; the readiness gate makes that safe, and an explicit false still opts out. Separate-instance pgvector gates readiness on the driver's NULL count instead of auto-filling. /health gains vector_store.vault_backfill {ready, applicable, null_remaining}.

HNSW under-fetch fix (#212)

Filtered dense search sets hnsw.iterative_scan = relaxed_order + a larger ef_search inside the query transaction, so a selective vault/source filter no longer post-filters a fixed global top-ef_search down to a handful of rows.

Web search UX (#213)

The results page requests a higher limit (25) and replaces the alarming "Truncated" warning with a calm informational note.

---

Verified: 88/0 E2E against production; backend unit + pgvector e2e + shell e2e green; same-instance auto-backfill behaviorally verified (NULLed points drained to 0, vault_ids match source).