feat(harness): port vectorstore dual-key + reader RPC (D11, §5.4)

Ports vectorstore/{rest_client,rest_writer,store,reader,embeddings,records},
evidence/model (leaf dep of records), and cli/_guards (require_vector_write_allowed
workstation write-guard). Renamed psdwp3->nsp, verbatim.

VectorRestClient gains an api_key property so reader/writer clients carry their
distinct keys visibly (spec D11: vector_reader / vector_writer on the same endpoint).

scripts/create_vector_reader_rpc.sql is NEW: the reader RPCs (search_similar,
list_tables) lived server-side in Supabase and were never versioned. Authored now
mirroring the writer allowlist pattern (table allowlist, security definer, revoke
from anon/authenticated, grant to vector_reader only). Writer RPC ported verbatim.

L1: test_vector_dual_key (7 tests) pins the dual-key construction + the workstation
write-guard (exit 4 without writer key).

harness/nsp/vectorstore/reader.py

@@ -0,0 +1,67 @@
+"""Lettura del pgvector dietro un'unica interfaccia `.search(query_vec, top_n, kinds)`, così
+`search.combined_search` resta agnostico al transport. Due implementazioni:
+
+- `RestSearcher`  → produzione: similarity search via REST (`search_similar`).
+- `DirectSearcher` → dev/test: connessione diretta a Postgres/pgvector.
+
+Entrambe mappano i `kind` sulle tabelle per-dominio dello schema `vectors`.
+"""
+
+from sqlalchemy import Engine
+
+from nsp.vectorstore.rest_client import VectorRestClient
+from nsp.vectorstore.store import VectorHit, VectorStore, hit_from_metadata
+
+# kind PsdWp3 → tabella dello schema `vectors`.
+KIND_TO_TABLE = {
+    "schema_table": "schema_records",
+    "schema_column": "schema_records",
+    "evidence": "evidence",
+    "memory": "memory",
+}
+ALL_TABLES = ["schema_records", "evidence", "memory"]
+
+
+def tables_for_kinds(kinds: list[str] | None) -> list[str]:
+    """Tabelle da interrogare per i kind richiesti (tutte se kinds è vuoto/None)."""
+    if not kinds:
+        return list(ALL_TABLES)
+    return sorted({KIND_TO_TABLE[k] for k in kinds if k in KIND_TO_TABLE})
+
+
+def _merge(hits: list[VectorHit], top_n: int) -> list[VectorHit]:
+    return sorted(hits, key=lambda h: h.similarity, reverse=True)[:top_n]
+
+
+class RestSearcher:
+    """Similarity search via REST: una chiamata `search_similar` per tabella, poi fusione."""
+
+    def __init__(self, client: VectorRestClient):
+        self.client = client
+
+    def search(
+        self, query_vec: list[float], top_n: int = 10, kinds: list[str] | None = None
+    ) -> list[VectorHit]:
+        hits: list[VectorHit] = []
+        for table in tables_for_kinds(kinds):
+            for row in self.client.search_similar(table, query_vec, top_n):
+                hits.append(hit_from_metadata(row.get("similarity", 0.0), row.get("metadata")))
+        return _merge(hits, top_n)
+
+
+class DirectSearcher:
+    """Similarity search diretta su Postgres/pgvector, interrogando le tabelle per-dominio."""
+
+    def __init__(self, engine: Engine, schema: str = "vectors", dim: int = 768):
+        self.engine = engine
+        self.schema = schema
+        self.dim = dim
+
+    def search(
+        self, query_vec: list[float], top_n: int = 10, kinds: list[str] | None = None
+    ) -> list[VectorHit]:
+        hits: list[VectorHit] = []
+        for table in tables_for_kinds(kinds):
+            store = VectorStore(self.engine, schema=self.schema, table=table, dim=self.dim)
+            hits.extend(store.search(query_vec, top_n=top_n))
+        return _merge(hits, top_n)