feat: P4 qdrant collection lifecycle (self-heal + guarded rebuild)

- shared TS collection manager: self-heal creates missing collection (1024/cosine)
  and missing keyword payload indexes; never mutates incompatible contracts
  (semantic_index_incompatible); async index visibility polled with bounded deadline
- session admission (qdrantEnsure) uses the manager in self-heal mode; operator path
  keeps require_existing semantics
- runtime lease exposes semanticQdrantUrl to the operator
- operator commands vector-inspect/vector-rebuild with exact confirmation guards
- thothctl workspace vector inspect|rebuild (Go) with --collection/--confirm/--destroy
- p4 acceptance runner: real Qdrant (v1.18.2) lifecycle checks, 11/11 PASS
- docs: CLI contract, manual walkthrough P4 (PENDING), PROJECT_STATE

scripts/test-p4-acceptance.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+bash -n "$repo_root/scripts/p4-acceptance.sh" "$repo_root/scripts/test-p4-acceptance.sh"
+node --check "$repo_root/backend/scripts/p4-acceptance.mjs"
+node --check "$repo_root/backend/scripts/p4-acceptance.test.mjs"
+npm --prefix "$repo_root/backend" run build
+node --test "$repo_root/backend/scripts/p4-acceptance.test.mjs"