fix(mcp): add grep timeout, error logging, and fs fallback on VikingDB failure

[lg320531124]

Problem

The grep tool silently swallows VikingDB query failures — except Exception: return (p, []) returns empty results with no logging, no retry, and no fallback. On large corpora (10K+ resources), VikingDB BM25 queries can timeout or return empty even when matching content exists.

Fix

Three improvements:

1. Timeout (OPENVIKING_GREP_TIMEOUT_SEC, default 10s): VikingDB queries that exceed this are cancelled and logged as warnings
2. Error logging: Failed queries now log the pattern, URI, and exception — no more silent failures
3. Fs grep fallback (OPENVIKING_GREP_FALLBACK_ON_EMPTY, default enabled): When VikingDB queries fail, retry with filesystem grep engine

Before

except Exception:
    return (p, [])  # silent empty result, no log, no retry

After

except asyncio.TimeoutError:
    logger.warning("grep: VikingDB query timed out for pattern %r", p)
    return (p, [], True)  # had_error=True triggers fallback
except Exception as exc:
    logger.warning("grep: VikingDB query failed for pattern %r: %s", p, exc)
    return (p, [], True)

Environment Variables

Variable	Default	Description
OPENVIKING_GREP_TIMEOUT_SEC	10	VikingDB query timeout in seconds
OPENVIKING_GREP_FALLBACK_ON_EMPTY	1	Enable fs grep fallback on VikingDB failure

Fixes #2850

[qin-ctx]

看了一下，这个 PR 先不合入，主要是当前实现没有真正解决 #2850 的问题。

现有 VikingFS._grep_vikingdb_then_fs() 在 VikingDB search_by_keywords 抛异常时已经会 fallback 到 _grep_fs()，所以这部分不需要在 MCP endpoint 再包一层。这个 PR 里创建了 GrepConfig(engine="fs")，但没有传给实际调用；fallback 分支仍然是再次调用同一个 service.fs.grep(...)，因此不会强制切到 fs grep。

另外，issue 里更关键的场景是“VikingDB 返回空结果，但内容实际存在”。当前改动只在 timeout/exception 时标记 had_error 并尝试 fallback，VikingDB 正常返回空列表时不会触发 fallback，所以这个场景仍然没修到。

建议后续把修复收敛到 VikingFS._grep_vikingdb_then_fs()：保留已有异常 fallback；如果需要支持空结果 fallback，就在 candidate_uris 为空的位置按配置调用 _grep_fs(...)；如果要加 timeout，也只包住 VikingDB 的 search_by_keywords(...) 调用，而不是在 MCP 层包整条 grep。先关闭这个 PR，后续可以基于这个方向重新提一个更小的修复。

[lg320531124]

Thanks for the precise review — all three points are addressed in the redo, #2900 (storage layer only, MCP untouched):

your feedback	redo
empty-result case was missed — VikingDB returns [] but content exists	candidate_uris empty now retries via _grep_fs(...) instead of returning an empty dict (the case #2854 never covered)
timeout should wrap only search_by_keywords, not the whole grep	wrapped in asyncio.wait_for(...); on TimeoutError → _grep_fs(...)
converge on VikingFS._grep_vikingdb_then_fs(), keep existing exception fallback	only viking_fs.py changed; except Exception branch untouched; timeout is a sibling except

No GrepConfig schema change (it is extra=forbid) — timeout is OPENVIKING_GREP_VIKINGDB_TIMEOUT_SEC, default 10s. No uv.lock churn. 17/17 tests pass, ruff clean.

Closing this one in favor of #2900 as you suggested.