[Epic]: Content and path exclusion controls

## Summary
Add content and path exclusion controls so a customer can mark repos or paths that must never be indexed or used for code suggestions — a standard control at every competitor, and a cheap, obvious parity gap to close.

## Intent / Source of truth
Standard at every competitor (GitHub ships per-repo/org content-exclusion globs). Coordinate with lightbridge-code-intelligence, which owns indexing. Source: 2026-08-13 enterprise-readiness research pass.

## Scope
- [ ] Repo/org-level content-exclusion glob configuration (data model + admin API)
- [ ] Enforcement in lightbridge-code-intelligence's indexing pipeline (coordination story with that repo)
- [ ] Admin UI/API for managing exclusion lists

## Out of scope
- Per-file dynamic exclusion based on content scanning (glob-based path exclusion only, matching the competitive bar)

## Verification
A path matching an exclusion glob is provably never indexed and never appears in a suggestion; a change to the exclusion list takes effect on the next indexing cycle without a full re-index requirement (or that requirement is explicitly documented).

## Risk assessment
This control only matters if lightbridge-code-intelligence's indexing pipeline actually honors it — needs a real cross-repo integration test, not just a config surface that assumes enforcement happens elsewhere.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

No files or tests are named. Start by tracing the repo/org exclusion data model and admin API in lightbridge-authz, then inspect the indexing pipeline in lightbridge-code-intelligence and its cross-repo integration-test path. Done means glob matches are never indexed or suggested, and list changes take effect on the next indexing cycle or the requirement is documented.

由索引模型根據 Issue 內容生成。