Semantic search via the entire-api gateway (v4)

Proxies semantic search to entire-search through the entire-api gateway, resolving the session cookie to a jurisdictional JWT and repo slugs to storage ULIDs. repo is a storage ULID or a forge-qualified gh/owner/repo | et/owner/repo slug; a bare owner/repo is rejected because same-named GitHub and native twins are distinct repos. It may be omitted (cross-repo: all accessible repos) or repeated (multi-repo). Response shape matches the shared search results contract.