B2B-4 · Isolation leak-test suite + compound indexes (quality gate)

Part of the B2B epic (Fase 1 · item 1.1d/e). Declaring "isolated" requires automated evidence, not just code review.

## What
- [ ] E2E leak-test suite: seed a private namespace, then assert **zero** exposure through every public surface (sitemap, search, home, stats, personality pages, public APIs)
- [ ] Cover **indirect signals**: counts, "last activity", badges — nothing may reveal that a private check exists (commons-model residual risk)
- [ ] Audit remaining compound indexes `(nameSpace, …)` on isolated collections (claims, claim-reviews, review-tasks, sources, verification-requests)
- [ ] Wire the suite as a CI quality gate

Existing infra: Vitest e2e with mongodb-memory-server and per-worker DB isolation (`server/tests/globalSetup.ts`, `per-worker-setup.ts`).

**Effort:** ~0.5–1 SP · **Depends on:** B2B-1, B2B-2, B2B-3