feat: list namespaces endpoint

[gdccyuen]

What

Adds GET /api/v1/documents/namespaces — returns the authenticated user's namespaces with active document counts.

{
  "namespaces": [
    {"namespace": "alpha", "document_count": 2},
    {"namespace": "beta",  "document_count": 1}
  ]
}

Why

Currently a user has no way to discover which namespaces they have uploaded documents to. Namespace is a free-form string label set at job creation; without a list endpoint, callers must track namespaces themselves (issue raised during self-hosted deployment review). The composite index idx_documents_user_namespace_status already covers the grouping query, so the cost is a single indexed scan.

Changes

• apps/api/app/repositories/document_repository.py — new list_namespace_counts_for_user (GROUP BY namespace over non-archived docs, covered by idx_documents_user_namespace_status).
• apps/api/app/services/documents/lifecycle_service.py — new list_namespaces service method.
• apps/api/app/api/v1/routes/documents.py — new GET /namespaces route, declared before /{document_id} so FastAPI matches the literal path first.
• apps/api/tests/contract/test_documents_contract.py — 2 contract tests:
  • per-user isolation: another user's namespaces are not visible; archived docs are excluded from counts.
  • empty case: returns {"namespaces": []} when the user has no documents.

Conventions matched

• Filter is status != "archived" (matches existing list_by_user_namespace), not status = "active".
• Auth via Depends(with_current_user); user-scoped at the repository layer.
• Response shape parallels list_documents: top-level dict with a list field.

Verification

uv run pytest apps/api/tests/contract/test_documents_contract.py -q
19 passed in 14.96s

(includes 17 existing tests — no regressions.)