Semantic search via the entire-api gateway (v4)

Proxies semantic search to entire-search through the entire-api gateway, resolving the session cookie to a jurisdictional JWT and repo slugs to storage ULIDs. repo may be omitted (cross-repo: all accessible repos) or repeated (multi-repo); both are gated on the semantic-search flag. Response shape matches the shared search results contract.