feat(kb): per-document metadata via sidecar JSON

Each file in the inbox can now be accompanied by a `<filename>.meta.json`
sidecar that supplies identifier, published_at, effective_at, and
source_url. The scanner applies filename-derived defaults first and lets
the sidecar override individual fields.

- list_inbox / list_failed skip `.meta.json` so sidecars aren't ingested
  as standalone documents.
- mark_processed, mark_failed, and requeue-failed move the sidecar
  alongside its parent (best-effort).
- mark_failed now sanitizes the error string to ASCII before writing it
  to S3 object metadata (HTTP header encoding).
- search SQL selects published_at/effective_at; the formatter shows the
  full heading_path plus publication date so citations are unambiguous.
- scripts/kb_sidecar_template.json documents the expected shape.

Refs Task Master #2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/kb_sidecar_template.json

@@ -0,0 +1,7 @@
+{
+  "title": "תקנה 37 — בדיקה מחדש",
+  "identifier": "127/2022",
+  "published_at": "2022-04-12",
+  "effective_at": "2022-04-12",
+  "source_url": "https://www.btl.gov.il/Laws1/00_0_127-2022.pdf"
+}