Fix retrieval correctness and input validation

[1816x]

Summary

• reject non-finite vectors at the Rust and Python boundaries
• prevalidate complete Python batches so failed inserts are atomic
• enforce valid chunk windows, bounded paragraph overlap, and no redundant final chunk
• filter weak retrieval matches with RAG_MIN_SCORE (default 0.09)
• expose the active threshold through GET /stats
• keep 0.15 available as an explicit stricter setting; the 0.09 default separates the bundled demo's relevant HNSW query (0.0930) from its off-topic regression (0.0407)
• add deterministic regression coverage and synchronize README test counts

Behavior changes

• Hnsw.insert, Hnsw.insert_batch, and Hnsw.search reject NaN and infinity
• a rejected batch leaves the index unchanged
• /query may return sources: [] when no retrieved chunk clears the threshold
• direct DocumentStore consumers remain unfiltered unless they set min_score

Test plan

GitHub Actions should run:

• cargo fmt --all --check
• cargo clippy --all-targets -- -D warnings
• cargo test
• bindings pytest
• service pytest
• Next.js production build

This PR intentionally excludes UI, upload security, CORS, and Claude timeout work; those remain in PRs 2 and 3.