feat: implement permission-aware search baseline

AGENTS.md

@@ -0,0 +1,15 @@
+# govoplan-search Codex Guide
+
+## Scope
+
+This module owns global and contextual search aggregation, the built-in
+PostgreSQL/SQLite index, indexing lifecycle, search diagnostics, and the search
+WebUI. Source modules own object authorization and the content they announce.
+Optional backends such as OpenSearch belong behind provider contracts.
+
+## Rules
+
+- Never return a result before tenant and current-principal ACL filtering.
+- Do not import optional source modules.
+- Keep external search engines optional.
+- Never index credentials, secrets, or unrestricted raw payloads.