RAG query pipeline: @rag-search retrieval endpoint + answer generation (#79)

[reekitconcept]

Step 3 of the RAG MVP (ticket: distribution-kitconcept-intranet#458, part of #79): a question to @rag-search returns {answer, sources} end to end. Second commit is the removable RAG: TESTING: UI aid.

What's included

• 3.1 Grounded prompt template: answer strictly from the provided context, decline when the answer is not in it, reply in the question's language; <think> blocks stripped
• 3.2 Query pipeline (rag/pipeline.py): embed the question → {!knn} chunk retrieval with the same security/path/language pre-filters as the classic search → collapse chunks to parent documents → generate. RagResult with error codes (not_configured / embedding_failed / generation_failed / solr_unavailable); generation failure still exposes the retrieved sources; empty retrieval is not an error
• 3.3 @rag-search restapi service on the pipeline (q required → 400, optional path_prefix/lang), replacing the TESTING draft endpoint
• Robustness: raw socket errors from a dead Solr server map to solr_unavailable instead of a 500
• Indexing fix (to the already-merged foundations): Image content is excluded from chunking — its only chunkable text is title/description, which polluted answer sources with photos; File stays included (its title/description locates real documents, and the post-MVP Tika body extraction builds on it)
• Docs: Step 3 design decisions and known issues (shared test Solr core, topK source tail) in IMPLEMENTATION-79.md
• TESTING commit: with the Use AI toggle on, the answer now renders above the classic result list instead of replacing it (the old routing displayed a misleading "No results")

Verification

Against the bundled German demo corpus (#89): golden questions 19/19 retrieval hits, 2/2 declines, no binary content cited as sources after the indexing fix; permission trimming holds (private pages absent for the plain member f.meier); RAG test suite 110 passed.