fix(knowledge): list knowledge bases on the same authority that creates them - #6770

…t query

The module resolves workspace authority one way everywhere — an explicit
permission row OR an organization admin role — except in the listing query,
which joined `permissions` and required a row. Both list surfaces authorized the
caller and then contradicted that authorization: an org admin could create a
knowledge base through /api/knowledge or /api/v1/knowledge and never see it
listed. Tables and files carry no such join.

Replace the caller-scoped query with `getLegacyPersonalKnowledgeBases`, which
answers only for workspace-less bases whose creator IS their only authority, and
have both surfaces read the workspace's own rows through
`getWorkspaceKnowledgeBases` after authorizing. The legacy rows keep riding along
so they stay reachable. The permissions join now appears nowhere in the module,
and the duplicated connector projection collapses onto the shared helper that
enforces the row cap.

…tate bugs

Cleanup pass over the knowledge module — effects, state, memo, callback, React
Query, url-state, emcn, and comments — keeping the fixes that change behavior for
the better and leaving the ones that would change how the UI feels.

Bugs found and fixed:
- Opening a document flashed "Document not ready" for a frame. The chunk-row
  builder rendered the loading state as a status claim: with no document loaded
  yet it fell through to the branch that reports a missing processing status.
- A partial upload failure skipped every cache invalidation, because the throw
  jumped past them, so the list stayed missing rows the server had already
  created. Admission failures create nothing and still skip the refetch.
- The document and chunk context menus captured the row they opened on, so the
  Enable/Disable label went stale under the list's own polling. They hold an id
  and resolve against live data now.
- The action bar's "Select all"/"Clear" links were painted with `--brand-primary`,
  which is defined nowhere: the links fell back to `currentColor` and were
  indistinguishable from the text beside them.

Consistency and weight:
- Mutations no longer invalidate `detail` non-exactly for writes that touch one
  document: that key is the parent of every documents page, chunk page, tag
  definition, and connector row cached for the base.
- Dead hook surface removed (five exports with no consumer, a query instantiated
  only to reach a cache helper, a `goToPage` that only range-checked), unused
  parameters dropped, `getErrorMessage` replacing hand-rolled instanceof checks.
- `page` joins the document list's param group, so a search resets pagination in
  the same debounced write instead of writing the URL on every keystroke.
- Icons import from `@sim/emcn/icons`, the action bar composes
  `chipFilledFillTokens` instead of restating it three times, chunk cells use the
  canonical content-label chrome, and the icon-only buttons have accessible names.

Follow-up from the quality pass. The two list queries had grown into near-copies
of each other — same 14-column projection, same document join, same cap check,
same row mapping — and the workspace-plus-legacy composition was pasted into both
the internal use case and the v1 route, one of which is a surface adapter that
should not be composing domain reads at all.

Both queries now read through one private projection, so a column added to one
list cannot go missing from the other half of the same rendered list, and
`listWorkspaceAndLegacyKnowledgeBases` owns the composition both surfaces call.
That merge also projects connector types once over the merged set instead of once
per source, and skips the copy-and-sort entirely when there are no legacy rows —
the common case.

Also from the review: the chunk-row memo depends on the two primitives it reads
rather than the whole polled document object, the selected chunk resolves in one
scan instead of two, an aborted chunk-search pagination throws instead of caching
a truncated result as complete, upload cache reconciliation no longer delays the
rejected promise, the key-hierarchy rule is stated once on the key factory rather
than six times at its call sites, and `TagDefinition` has one declaration.