Semantic retrieval, grounded tier, and webhooks

Three new API surfaces: GET /api/v1/semantic-search retrieves drug-record passages by meaning (pgvector embeddings with a lexical fallback — the response reports which path answered); POST /api/v1/grounded is the first key-gated tier, returning the same passages with per-span citations that carry full provenance for LLM consumers; and /api/v1/webhooks registers HMAC-signed outbound webhooks on dataset changes so caches can invalidate instead of polling this feed.