Fix dynamic database-backed RAG readiness

[anpa1200]

Summary

• make corpus reconciliation incremental and near-live (15-minute default) while preserving unchanged chunk IDs and embeddings
• derive business relevance dynamically from local Threat Radar company spaces and asset inventory
• enforce company-space scoping for private asset retrieval across REST, UI, and all MCP tools
• add bounded business-context relationship pivots for IOC/CVE discovery
• probe the real private embedding endpoint and include model, dimensions, corpus freshness, and vector coverage in RAG/self-test readiness
• bootstrap the first dynamic index through the real REST/worker path and make concurrent self-tests transaction-safe
• expose local company spaces in the Navigator RAG assistant and document the operational model

Validation

• full backend: 742 passed, 10 skipped; 67.89% coverage
• focused RAG/self-test regression suite: 72 passed
• focused MCP/RAG contracts: 114 passed
• frontend ESLint and TypeScript/Vite production build: passed
• Ruff and Black: passed
• Bandit and dependency audits: passed
• Gitleaks: no leaks found
• Docker Compose render and end-to-end self-test: passed
• live read-only API operation smoke suite: passed
• Helm lint and render: passed
• module documentation coverage: all 31 modules documented exactly once
• real local embedding smoke: nomic-embed-text, 768 finite non-zero dimensions
• GitHub Actions: 25 of 25 jobs passed on head 10bc29a

Notes

The existing Vite large-chunk advisory remains non-blocking and is unrelated to this change. This draft PR does not merge or deploy itself.