feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

docs/architecture/components.md

@@ -7,7 +7,9 @@ This page complements the [architecture overview](overview.md) with the module s
 The frontend communicates with the backend through REST and SSE. The backend does not own session
 persistence: it starts Pi, invokes the `tht` CLI, and forwards events. It does own the separate
 installation-local database catalog. The harness contains the workflow, the Python CLI, and
-adapters for the DWH and vector store.
+adapters for the DWH and vector store. Its Memory module also owns the authoritative
+PostgreSQL archive of cards, links, dependencies and pending Qdrant projections.
+Administrative API calls use the same harness service as workflow producers and recall.
 
 ```mermaid
 flowchart LR
@@ -20,6 +22,7 @@ flowchart LR
     THT --> FS["Sessions and artifacts\nworkspace repository"]
     THT --> DWH["DWH\nread-only"]
     THT --> VDB["Qdrant / vector store"]
+    THT --> MEM["thoth_memory\nPostgreSQL Memory archive"]
     BE --> CFG["settings.json\nworkspace + thinking"]
     BE --> MODELS["generated runtime catalog\nfrom installation YAML"]
     BE --> CAT["catalog-db\nPostgreSQL + Kysely"]