feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

frontend/e2e/fixtures/auth-stack.mjs

@@ -85,7 +85,7 @@ dwh:
   supported_transports: [postgres_direct]
 `;
 
-async function prepareF1Workspace(root) {
+async function prepareF1Workspace(root, memoryOnly = false) {
   const source = join(root, "workspace-source");
   const remote = join(root, "workspace-remote.git");
   secureDirectory(source);
@@ -97,7 +97,8 @@ async function prepareF1Workspace(root) {
     "    name: Fixture workspace",
     "",
   ].join("\n"));
-  writeSecure(join(source, F1_WORKSPACE_ID, "workspace.yaml"), F1_WORKSPACE_DESCRIPTOR);
+  writeSecure(join(source, F1_WORKSPACE_ID, "workspace.yaml"),
+    memoryOnly ? F1_WORKSPACE_DESCRIPTOR.split("dwh:")[0] : F1_WORKSPACE_DESCRIPTOR);
 
   await runFixtureCommand("git", ["init", "--bare", "--initial-branch=main", remote], root);
   chmodSync(remote, 0o700);
@@ -332,7 +333,7 @@ function cleanBackendEnvironment(overrides) {
   return { ...env, ...overrides };
 }
 
-export async function createAuthenticationStack({ withF1Workspace = false } = {}) {
+export async function createAuthenticationStack({ withF1Workspace = false, memoryRuntime = {} } = {}) {
   const credentials = resolveFixtureCredentials();
   const root = mkdtempSync(join(realpathSync(tmpdir()), "thothii-auth-e2e-"));
   secureDirectory(root);
@@ -363,7 +364,7 @@ export async function createAuthenticationStack({ withF1Workspace = false } = {}
   const [frontendPort, backendPort] = await Promise.all([freeLoopbackPort(), freeLoopbackPort()]);
   const publicUrl = `http://127.0.0.1:${frontendPort}`;
   const backendUrl = `http://127.0.0.1:${backendPort}`;
-  const workspace = withF1Workspace ? await prepareF1Workspace(root) : undefined;
+  const workspace = withF1Workspace ? await prepareF1Workspace(root, Object.keys(memoryRuntime).length > 0) : undefined;
   const provider = await startFakeOidcProvider({
     directory: providerRoot,
     registration: {
@@ -515,6 +516,7 @@ export async function createAuthenticationStack({ withF1Workspace = false } = {}
           THT_WS_FIXTURE_WORKSPACE_DWH_PASSWORD_FILE: fixtureDwhPasswordFile,
           THT_WS_FIXTURE_WORKSPACE_DWH_TLS_CA_FILE: fixtureDwhCaFile,
         } : {}),
+        ...memoryRuntime,
       });
     }
 
@@ -535,6 +537,10 @@ export async function createAuthenticationStack({ withF1Workspace = false } = {}
 
     return {
       publicUrl,
+      fixtureWorkspaceRoot() {
+        if (!workspace) throw safeError("e2e_workspace_fixture_missing");
+        return join(registryRoot, "repo", workspace.id);
+      },
       localAccount(account) {
         const found = accounts[account];
         if (!found) throw safeError("e2e_local_account_unknown");