fix(retrieval): scope group_id as must in qdrant search filter

The group_id condition was attached to filter.Should, which only contributes
to scoring instead of restricting the result set. Combined with the tenant
must condition this allowed points outside the requested groups to be
returned. Append the match into filter.Must so group scoping is enforced.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/retrieval/qdrant.go

@@ -195,9 +195,7 @@ func (s *qdrantStore) Search(ctx context.Context, req SearchRequest) ([]SearchPo
 	}
 	groupIDs := normalizeGroupIDs(req.GroupIDs)
 	if len(groupIDs) > 0 {
-		filter.Should = []*sdk.Condition{
-			sdk.NewMatchInts("group_id", groupIDs...),
-		}
+		filter.Must = append(filter.Must, sdk.NewMatchInts("group_id", groupIDs...))
 	}
 
 	points, err := s.client.Query(ctx, &sdk.QueryPoints{