feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

docs/evidence.md

@@ -2,7 +2,30 @@
 
 This page describes the complete workspace Evidence lifecycle: where original material lives, how curated units are produced, when they become available at runtime, and what the author and reviewer are responsible for.
 
-## Publication rule
+## Editable local Evidence
+
+E1 adds [Curated Evidence v4 and a persistent local archive](contracts/curated-evidence-v4.md).
+The visible title and payload fields are authoritative Markdown. New manual units need no
+external source; consolidation records their curator and distinguishes later corrections
+from original documentary provenance. The core archive API creates immutable candidates
+and advances its active pointer only after successful indexing.
+
+E2 adds **Administration → Evidence management**, actual host file paths, complete
+browsing and filtering, and the installed `tht workspace evidence consolidate
+--workspace <id>` command. Edit files externally, consolidate to activate them, then
+review and run Git manually. Runtime consumes only the active local snapshot.
+The [v4 contract](contracts/curated-evidence-v4.md#administration-and-installed-command)
+describes host mounting, first conversion, failure recovery and Clear behavior.
+The local PSD preview has 35 converted and indexed units. E3 adds explicit import/refresh
+from local drafts and configured HTTP/S3 sources, durable current/proposed comparisons,
+and keep/replace decisions with activation and retry. See
+[Import drafts and refresh sources](contracts/curated-evidence-v4.md#import-drafts-and-refresh-sources).
+Workflow gate corrections remain the subsequent shared increment, X1.
+
+## Existing repository publication path
+
+The remainder describes the legacy, uninitialized repository source path. Initialized
+v4 local archives use the lifecycle above; manual declarations need no source document.
 
 The workspace repository is the versioned source. ThothII reads it, validates it, and publishes an atomic generation. It does not modify, commit, or push the author's repository.
 
@@ -46,7 +69,33 @@ The legacy configuration may expose `source_root`, such as `${THT_DOCS_ROOT}` or
 
 HTTP and S3 are separate adapters. They do not use the filesystem structure `source/` and `curated/`, but they must still provide stable provenance, without credentials in URIs, under the adapter-specific contract.
 
-## What a curated unit must contain
+## What an editable curated unit contains
+
+New preparation produces unit schema v4. The first H1 contains its title; documented H2
+sections contain the typed payload. A minimal manual unit is:
+
+```markdown
+---
+schema_version: 4
+id: evidence:order-key
+kind: domain
+language: en
+purposes: [sql_generation]
+---
+
+# Order key
+
+## Rule
+
+Join orders using the order number, financial year and company.
+```
+
+Use `tht evidence migrate <workspace-root>` for deterministic legacy conversion. The
+conversion preserves typed content and initializes an archive baseline; it does not
+activate the local corpus. See the [v4 contract](contracts/curated-evidence-v4.md) for
+all eight kinds, provenance, file layout and the E1/E2 boundary.
+
+## Legacy v3 representation
 
 Canonical Curated Evidence v3 hides canonical machine metadata in an HTML comment and renders the
 whole review surface as real Markdown. GitHub therefore shows no frontmatter table. The body layout
@@ -94,7 +143,7 @@ La fascia pediatrica comprende i pazienti con età inferiore a 18 anni.
 The actual files contain invisible `tht:` comments for canonical metadata and typed-field
 boundaries. Removing, duplicating, or desynchronizing them makes validation fail closed instead of
 silently ignoring content. Unit schemas v1 and v2 remain readable for compatibility, but newly
-prepared units use v3.
+prepared units use v4. Unit v3 remains readable as a conversion input.
 
 Curated units must be atomic, readable by a second reviewer, and supported by the source.
 Provenance references must lead back to the original file and the passage that supports the claim.