test(e2e): cover the ingestion slice against real Postgres, MinIO, and Qdrant

Why:
- the slice's reliability invariants (ADR-0016) had no end-to-end coverage.

Changes:
- 13 Testcontainers-based tests: duplicate upload, retry after a failed job,
  cross-tenant 404, unregistered domain, capacity 503, timeout 504, parse 400,
  real Qdrant 502, missing scope 403, and both readiness states
- only the dense embedders are faked (ADR-0016 bars live providers); they
  return the pinned 768/3072 dimensions
- the capacity test uses a committing sessionmaker, since the shared-connection
  fixture cannot serve concurrent sessions

Impact:
- runs in the default `uv run pytest`; needs Docker, like every integration test

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/fakes.py

@@ -32,6 +32,9 @@ class FakeDenseEmbedder:
 
     name: str
     dimensions: int = 4
+    value: float = 0.0
+    """Component value of every returned vector. Non-zero where a real Qdrant
+    has to score the result, since a zero vector has no direction to compare."""
     model_version: str = "fake-dense-v1"
     calls: list[list[str]] = field(default_factory=list)
     fail_next: bool = False
@@ -45,7 +48,7 @@ class FakeDenseEmbedder:
         if self.fail_next:
             self.fail_next = False
             raise RuntimeError("simulated embedder failure")
-        return [[0.0] * self.dimensions for _ in texts]
+        return [[self.value] * self.dimensions for _ in texts]
 
 
 @dataclass