[REVIEW] dms: method-based record ACL (mail.message pattern) vs sentinel ir.rules

[dnplkndll]

Option B from the access-design review — the cleanest, standards-matching answer to victoralmau's question on OCA#475 about the new _search override.

Diff = the full refactor vs the current override version (net −99 lines: 66 ins / 165 del).

What the Odoo 19 source shows (why B)

• The computed-Boolean + search= + ir.rule sentinel (domain_force=[('permission_<op>','=',user.id)]) appears nowhere in core 19.0 (all 77 core user.id rules target real stored columns).
• It broke because 19.0's Domain optimizer coerces the user.id sentinel to the Boolean field's type before the search= method runs (domains.py:1453-1470) — the uid is gone (value=[True]), so the rule stops filtering.
• Core's canonical analogue (mail.message) does dynamic, relation-table-driven, per-user visibility via _search + _check_access overrides with SQL subqueries — no ir.rule, no sentinel (mail_message.py:317,453).

This PR

• Override _search → AND in OR(access_groups, inheritance) read domain.
• Override _check_access → subtract DMS-forbidden records via _get_forbidden_dms_access (SQL search; the domain carries a subquery so it can't go through filtered_domain). create/write/unlink are enforced by core via check_access.
• Removed: 8 sentinel ir.rules; the _get_permission_domain sentinel-decode HACK; filtered_domain, _filtered_access/_filtered_access_no_recursion, _check_access_dms_record, and the write/unlink overrides.
• Kept: permission_<op> computed fields + search= (still used by directory_id's domain) — but the search method is now a plain access-domain builder, no sentinel.
• Kept: all 8 functional ir.rules (multi-company, file-locked, group-ownership, hidden-storage).

Proof (dev-runner 19.0, fresh DB, --without-demo=all)

• 0 failed / 64, incl. all read-isolation tests (test_file_access, test_unaccessible_file, test_inaccessible_directory, test_storage_attachment_record_db_unlink, test_permission_portal_user_access_other_attachment) and both portal tours.

Comparison artifact for OCA#475 — not auto-applied upstream.