search: Phase 4 federation merge + ACL post-filter + 21 tests

fedIndex merges per-peer inverted indices (union posting lists per term) after
relabelling local DocIds to global gid = peer*1000 + local — dedupe by
(peer,doc-id) is automatic and positions survive, so ranking runs once over the
merge and interleaves peers by score. ACL is a post-rank filter over an injected
permit predicate (searchTfIdfAcl/topNTfIdfAcl/searchBm25Acl). Roadmap complete,
122/122.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/search/api.sx

@@ -3,7 +3,8 @@
 ;; (e.g. "result = lookupTerm \"cat\" idx\n") and evaluate via the haskell-on-sx
 ;; interpreter. Public Haskell entry points: indexDoc, lookupTerm, deleteDoc,
 ;; docFreq, allTerms, tokens, positioned, evalQuery, parseQuery, searchQuery,
-;; rankTfIdf, rankBm25, topNTfIdf, topNBm25.
+;; rankTfIdf, rankBm25, topNTfIdf, topNBm25, fedIndex, aclFilter, searchTfIdfAcl,
+;; topNTfIdfAcl, searchBm25Acl.
 
 (define
   search/src
@@ -16,4 +17,6 @@
     "\n"
     search/parse-src
     "\n"
-    search/rank-src))
+    search/rank-src
+    "\n"
+    search/fed-src))