feat(search): enforce access-aware retrieval filtering

[alucero270]

feat(search): enforce access-aware retrieval filtering

Summary

Ensure retrieval only returns results the authenticated user is allowed to see based on source-scoped permissions.

Scope

• Files: retrieval logic, authorization integration points, search docs as needed
• Components: access-aware filtering, retrieval authorization, source-scoped result visibility

Acceptance Criteria

• retrieval excludes documents from unauthorized sources
• access-aware filtering is consistent across search and document retrieval flows
• the behavior is documented clearly enough to test and verify

Notes

• This issue is about enforcing permissions inside retrieval behavior