fix: harden retrieval snapshot loading

[suguanYang]

Summary

• Capture current document revisions before loading map-nav snapshots, preventing mixed-revision retrieval inputs during republish races.
• Load chunks with bounded keyset pagination and add a concurrent PostgreSQL order index with invalid-index recovery.
• Preserve exact retrieval inputs, including duplicate rows and deterministic ordering.
• Return HTTP 405 with Allow: POST for invalid GET requests to /v2/retrieval/query.
• Split snapshot contracts into focused consistency, batching, and large-corpus modules.

Verification

• Snapshot contracts: 3 passed.
• Migration contracts: 6 passed.
• Ruff: passed.
• Pyright: 0 errors.

Rollout

Apply the Alembic migration, then compare snapshot latency, database load, cancellations, memory, and retrieval-result equivalence in Logfire. This guarantees bounded and revision-consistent loading; it does not claim a universal wall-clock speedup.