feat(search): apply ReBAC repository access filtering

[csg-pr-bot]

Summary:

• Replaces organization/Namespace-based private repository filtering with OpenFGA ReBAC (can_read / ListObjects) to ensure search results accurately reflect actual user permissions.
• Caches the user's authorized repository list per UUID (5-minute TTL) and uses singleflight to deduplicate concurrent OpenFGA requests.
• Bypasses shared search result caches for private repository queries to prevent cross-user permission leaks, while maintaining admin access and public visibility for unauthenticated users.

[csg-pr-bot]

Depends on #1484