Knowledge index (RBAC)

Each document lists the roles allowed to read it. Search drops documents the agent can't read before ranking, so hidden documents never shape results. Roles are granted and revoked by the operator.