v2: Add provenance-preserving federated local search

[jmcte]

Problem / intent

An all-in-one local crawler becomes useful when an operator can search across provider archives, but merging Apple identities and derived claims too early creates privacy and correctness risk.

Acceptance criteria

• Add a bounded local search API over opted-in provider archives.
• Return provider id, stable local record id, timestamp, sensitivity, snippet/redaction state, and evidence/provenance for every hit.
• Preserve provider-native records; do not create global people/place/trip identities by default.
• Support provider filters, time bounds, pagination, and deterministic ranking.
• Make high-sensitivity providers and body indexing explicit opt-ins.
• Define retention, reindex, schema-migration, and deleted-record behavior.
• Add synthetic cross-provider ranking, pagination, redaction, and provenance tests.

Dependencies

• Depends on v2: Define a versioned provider capability manifest #89 and resumable provider archives.
• Photos and Messages join only after their v2 provider issues land.