feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

docs/contracts/workspace-preprocessing-cli.md

@@ -14,12 +14,30 @@ tht --installation <absolute>/thothii-installation.yaml workspace preprocess run
 
 tht --installation <absolute>/thothii-installation.yaml workspace preprocess clear
   --workspace <id> [--json]
+
+tht --installation <absolute>/thothii-installation.yaml workspace evidence consolidate
+  --workspace <id> [--json]
+
+tht --installation <absolute>/thothii-installation.yaml workspace evidence refresh
+  --workspace <id> [--json]
+
+tht --installation <absolute>/thothii-installation.yaml workspace evidence decide
+  --workspace <id> --source-id <64-hex> --revision <64-hex>
+  --decision keep|replace [--json]
 ```
 
 There are no public partial commands for DWH introspection, LSH, FK suggestions, schema indexing,
-Evidence indexing, or Qdrant rebuild. `preprocess run` does not accept `--resume`, `--dry-run`, a
+or Qdrant rebuild. The separate Evidence curation command validates editable local files and
+activates only their index; it does not satisfy workspace preprocessing readiness or execute Git.
+See [Curated Evidence v4](curated-evidence-v4.md#administration-and-installed-command).
+Source refresh acquires and refines only on explicit request, saving comparisons without
+changing active Evidence. Source decisions activate through the same Evidence-only
+pipeline and preserve Catalog readiness. Their envelopes reject arbitrary URLs, paths
+and extra flags; source locations and credentials come from installation configuration.
+`preprocess run` does not accept `--resume`, `--dry-run`, a
 generation identifier, or a rollback option. Re-running it replaces the preceding derived output.
-`preprocess clear` removes all replaceable preprocessing output and preserves runtime memory.
+`preprocess clear` removes all replaceable preprocessing output and preserves runtime memory
+and the canonical local Evidence archive. Full preprocessing remains required afterward.
 
 ## Sources of truth
 
@@ -29,8 +47,10 @@ generation identifier, or a rollback option. Re-running it replaces the precedin
 - PostgreSQL Metadata Catalog is the sole database authority. It owns the workspace/database
   association, installation-local binding, tables, columns, descriptions, sensitivity flags,
   physical foreign keys, and active logical relationships.
-- The workspace Git revision remains authoritative for Evidence. Evidence Descriptor v1/v2 and
-  Curated Evidence Unit v3 are unchanged; there is no Evidence v4.
+- Evidence Descriptor v1/v2 still configures the initial source. Initialized archives use
+  editable Curated Evidence Unit v4 and the last successfully activated local snapshot.
+  Ordinary preprocessing never imports unconsolidated working-tree edits. Before initialization,
+  the pinned workspace Git source remains supported.
 
 No metadata is imported from legacy workspace YAML or `physical.yaml`/`annotations.yaml`.
 
@@ -98,9 +118,8 @@ generation produced for another database or revision.
 
 `workspace preprocess clear` is intentionally narrower than deleting all semantic data. It:
 
-1. copies any `memory` and `solved_question` records still present in the pre-split workspace
-   collection to `<workspace>-memory`, then retires that legacy collection (a normal preprocessing
-   write performs the same one-time cutover if clear was not invoked first);
+1. leaves `<workspace>-memory` unchanged; Memory projections are reconstructed only from
+   the authoritative PostgreSQL archive, never imported from legacy vector payloads;
 2. deletes `<workspace>-reference`;
 3. removes the active LSH generation, Evidence corpus, private Catalog snapshot, and derived job
    checkpoints;