feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

compose.yaml

@@ -13,6 +13,7 @@ services:
       THT_BIN: /opt/venv/bin/tht
       THT_DATA_ROOT: /data
       SETTINGS_FILE: /data/settings/settings.json
+      THT_EVIDENCE_HOST_REGISTRY_ROOT: ${THT_WORKSPACE_REGISTRY_ROOT:-}
       THT_MAINTENANCE_FILE: /data/settings/maintenance.json
       THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
       THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:?set THT_WORKSPACE_GIT_REMOTE}
@@ -99,7 +100,7 @@ services:
     image: thothii-core:local
     profiles: [catalog-maintenance]
     pull_policy: never
-    command: ["node", "/app/backend/dist/catalog/migrate.js"]
+    command: ["bash", "/app/docker/catalog-migrate.sh"]
     environment:
       THT_CATALOG_DB_HOST: catalog-db
       THT_CATALOG_DB_PORT: "5432"
@@ -153,7 +154,7 @@ services:
       - type: volume
         source: workspace-registry
         target: /data/workspace-registry
-        read_only: true
+        read_only: false
       - type: volume
         source: sessions
         target: /data/sessions