Search results still need authorization filters

Search returning a hit does not mean this user may open that document.

If your index skips the same authorization filter as the detail endpoint, ranking and snippets become an oracle for hidden records. Filter by actor, object, and action before you score, highlight, or return results — the same rules as a direct GET.