feat(mcp): search all projects with one scoped query per database

[phernandez]

Summary

Fifth PR in the #1558 stack, on top of #1567 (the QUERY /v2/search/ route). Moves search_notes(search_all_projects=True) from one search per project onto the scoped route: one query per database, with the server attributing every hit to its project.

• One query per database. Accessible projects are grouped by where they live: the local database is one group, and each cloud workspace is one group. Each group is one QUERY /v2/search/ call through the new ScopedSearchClient, carrying that group's internal project ids. A local vault with twelve projects is now one query instead of twelve.
• Attribution comes from the server. Results are qualified (permalink, file path, project name) from project_external_id on each hit, not from which request returned it. A name collision across workspaces can no longer route a hit to the wrong project.
• projects subset parameter. search_notes(projects=["beta", "<external id>"]) searches a chosen set through the same grouping and merge. An unknown name is an error before any query runs.
• Failure semantics kept. Cross-database results merge by score and slice to the requested page. One failing database is skipped with a warning and an inexact total. A retryable outage (503) fails the merged page. Every database failing is a # Search Failed answer, not an empty one. A server too old to attribute its results raises a version-skew error, the same shape as the existing valid-time skew check.
• Readiness guidance per project. An empty page from a database is only trusted after each project in it has passed project_index_required.
• list_memory_projects now includes the internal id in its merged rows, which is what the scoped route addresses projects by. The temporal-confirmation check is shared by both search clients.

Cloud follow-up (after the stack lands and cloud re-pins): the cloud proxy forwards QUERY paths to the tenant Core, and the hosted factory yields the tenant client, so this path works there without further changes to the tool. Per Paul's sequencing, the cloud-side work follows the core PRs.

Test plan

• just fast-check
• tests/mcp and tests/api (1835 passed)
• Rewritten test_search_notes_multi_project.py: one call per workspace, local projects share one call, page prefix math across databases, opt-in, empty project list, one failing database, all failing, 503, readiness per project, projects subset across databases, unknown name, attribution skew, ref parsing
• Rewritten test_search_notes_multi_project_temporal.py: valid-time filter forwarded to every database, overlap filter, malformed filter refused before any query, zero projects still confirms the filter
• test_cjk_search_guidance.py and the SPEC-82 skew test in test_tool_search_temporal.py adapted to the scoped client
• test_tool_contracts.py signature updated for projects

Refs #1558

🤖 Generated with Claude Code

https://claude.ai/code/session_019YW9ysxugGGBCNEGzsxtFV

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.