RAG access control

Permission-aware RAG enforces identity filtering at retrieval time, not UI render. Where the filter sits, how to model row-level security,…