feat: P4 qdrant collection lifecycle (self-heal + guarded rebuild)

- shared TS collection manager: self-heal creates missing collection (1024/cosine)
  and missing keyword payload indexes; never mutates incompatible contracts
  (semantic_index_incompatible); async index visibility polled with bounded deadline
- session admission (qdrantEnsure) uses the manager in self-heal mode; operator path
  keeps require_existing semantics
- runtime lease exposes semanticQdrantUrl to the operator
- operator commands vector-inspect/vector-rebuild with exact confirmation guards
- thothctl workspace vector inspect|rebuild (Go) with --collection/--confirm/--destroy
- p4 acceptance runner: real Qdrant (v1.18.2) lifecycle checks, 11/11 PASS
- docs: CLI contract, manual walkthrough P4 (PENDING), PROJECT_STATE

backend/test/workspace-maintenance.test.ts

@@ -83,3 +83,32 @@ test("raw exception text is redacted from stderr and stdout remains within the p
   expect(captured.stderr.join("")).not.toContain("secret.example.invalid");
   expect(captured.stderr.join("")).not.toContain("SELECT *");
 });
+
+test("vector-inspect and vector-rebuild dispatch to the service with the exact envelope", async () => {
+  const service = {
+    vectorInspect: vi.fn(async () => ok("vector inspect")),
+    vectorRebuild: vi.fn(async () => ok("vector rebuild")),
+  } as any;
+
+  const inspectIo = io(JSON.stringify({ schemaVersion: 1, workspaceId: "psd-clinical" }));
+  expect(await runWorkspaceMaintenanceCli(["node", "workspace-maintenance", "vector-inspect"], service, inspectIo)).toBe(0);
+  expect(service.vectorInspect).toHaveBeenCalledWith({ workspaceId: "psd-clinical" });
+  expect(JSON.parse(inspectIo.stdout.join(""))).toMatchObject({ operation: "vector inspect", code: "ok" });
+
+  const rebuildIo = io(JSON.stringify({ schemaVersion: 1, workspaceId: "psd-clinical", collection: "psd-clinical", confirm: "psd-clinical", destroy: true }));
+  expect(await runWorkspaceMaintenanceCli(["node", "workspace-maintenance", "vector-rebuild"], service, rebuildIo)).toBe(0);
+  expect(service.vectorRebuild).toHaveBeenCalledWith({
+    workspaceId: "psd-clinical",
+    collection: "psd-clinical",
+    confirm: "psd-clinical",
+    destroy: true,
+  });
+});
+
+test("vector-rebuild without exact confirmation is refused by the service", async () => {
+  const service = {
+    vectorRebuild: vi.fn(async () => ({ ...ok("vector rebuild"), status: "failed", code: "semantic_index_incompatible" as const })),
+  } as any;
+  const rebuildIo = io(JSON.stringify({ schemaVersion: 1, workspaceId: "psd-clinical", collection: "other", confirm: "other", destroy: true }));
+  expect(await runWorkspaceMaintenanceCli(["node", "workspace-maintenance", "vector-rebuild"], service, rebuildIo)).toBe(1);
+});