feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

docs/plans/2026-09-09-evidence-e2-validation.md

@@ -0,0 +1,86 @@
+# Evidence E2 — validation
+
+Date: 2026-09-09. E2 is implemented locally and installed on the existing Docker preview.
+E3 source imports/refresh and X1 deliberate Memory/Evidence workflow corrections remain open.
+
+## Delivered behavior
+
+- Independent **Administration → Evidence management**, after Memory, protected by
+  `evidence.manage`: complete typed content, provenance and original excerpts, review items,
+  pagination, search, kind/purpose/status and scope/source filters, sort, and refresh.
+- Working-file states distinguish active, modified, new, removed, invalid, legacy and review
+  required. Detail shows the actual configured host path with copy controls. Instructions
+  cover external editing, all eight Markdown templates, consolidation and manual Git.
+- Installed `tht workspace evidence consolidate --workspace <id> [--json]` uses a closed
+  maintenance envelope. First use converts legacy units. Validation, immutable candidates,
+  activation and retry run through the existing corpus pipeline without a DWH scan or Git.
+- Runtime and ordinary preprocessing consume the active local snapshot. Unconsolidated
+  edits remain excluded. Catalog/Schema readiness is not advanced by this operation.
+  Clear preserves curated files, archive metadata and Memory; full preprocessing must
+  recreate the missing Reference/Schema derivations afterward.
+- Immutable runtime lease filenames now identify rendered bytes as well as logical input
+  identity. This fixes upgrades colliding with old runtime files without changing Catalog
+  fingerprints or removing the checks against tampered files.
+
+## Automated checks
+
+The complete backend suite passed: **1,355 tests**, 40 skipped. The complete frontend
+suite passed: **639 tests**. Both TypeScript checks passed. Native Go workspace operation
+and CLI tests passed, including rejection of arbitrary consolidation flags. Ruff passed
+for changed Python implementation and test files.
+
+The harness run passed **1,248 tests**, with one skipped and five deselected. Its three
+portable-path tests failed because that run deliberately set `THT_HOME` to the test
+runtime; rerunning the portable tests with `THT_HOME` unset passed. The final focused
+administration/path suite passed all 18 tests, including actionable migration errors and invalid
+consolidation combinations rejected before cleanup or indexing.
+
+The real-Qdrant integration test exercised the actual harness consolidation CLI with
+deterministic embeddings: all 35 PSD units converted and indexed with stable identities;
+active-only source selection; separate Schema and Memory canaries; Clear and rebuild
+from the retained snapshot. Unit tests cover validation, saved-but-unindexed failure,
+retry, browsing/filtering, no automatic Git, and no Catalog mutation from consolidation.
+
+A temporary Git repository and bare local remote exercise the documented manual sequence:
+edit, add and remove files, consolidate, inspect, stage the complete Evidence tree,
+commit, push and clone. The clone retains changed content, additions, deletions, managed
+metadata and an accessible active snapshot. No remote user repository was pushed.
+
+## Installed preview
+
+The existing Compose project is `thothii-18998cca7b0a`, at `http://127.0.0.1:8080`.
+The persistent editable checkout is:
+
+```text
+/Users/mp/projects/ThothII/deploy/psd/evidence-registry/repo/psd-clinical/evidence
+```
+
+The original registry checkout was copied from its retained Docker volume. The original
+author repository was not changed. Core and maintenance share a nested host bind for
+`repo`; registry state/snapshots and all other existing data volumes were retained.
+The installation descriptor includes the existing workspace bindings and the new
+`evidence-host.yaml` override. The previous descriptor and native binary are backed up
+at `/private/tmp/thothii-installation-before-e2.yaml` and `/private/tmp/tht-before-e2`.
+
+The real installed command succeeded with **35 documents, 35 chunks, 35 changed, zero
+removed**, using the configured embedding service and Qdrant. A second run succeeded
+with **35 unchanged, zero changed**. Reading the actual archive from core returned
+35 active units and no file errors. All five long-running services are healthy.
+Only the Evidence stage ran. The strict documentation build and `git diff --check`
+also passed. The stack launcher is `bash /private/tmp/thothii-memory-preview.sh`; keep its
+worktree image-build override until this branch is integrated into the main checkout.
+
+Browser verification reached the local login page. The saved administrator password
+does not match the current account hash, so the authenticated visual check remains
+manual. No account or password was modified. React interaction tests cover navigation,
+detail, host paths, templates, filtering, pending activation and invalid files.
+
+## Boundaries
+
+There is no web content editor, watcher, automatic commit/push, or implicit source refresh.
+The API exposes administration reads and consolidation; the archive's revision-checked
+save/remove operations remain available for the later explicit workflow corrections.
+These gates are not claimed as implemented by E2. Initialized local archives retain
+structural/review checks but bypass the legacy fixed retrieval-evaluation fixture so
+its old expected IDs cannot veto deliberate deletions. A general retrieval benchmark
+is outside the agreed scope.