feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

frontend/src/api/client.ts

@@ -7,6 +7,8 @@ import {
 
 const MAX_ERROR_BODY_BYTES = 8 * 1024;
 const safeErrorCodes = new Set([
+  "evidence_unavailable", "evidence_not_found",
+  "memory_invalid", "memory_forbidden", "memory_not_found", "memory_conflict", "memory_unavailable",
   "auth_forbidden", "auth_invalid_credentials", "auth_not_authorized", "auth_unavailable",
   "auth_not_implemented", "authentication_required", "invalid_credentials", "login_rate_limited",
   "csrf_failed", "csrf_invalid", "dwh_unreachable", "model_unavailable",
@@ -46,6 +48,13 @@ type SafeErrorPayload = {
 };
 
 const localCodeMessages: Record<string, string> = {
+  evidence_unavailable: "Evidence archive is unavailable. Check the local files and installation configuration.",
+  evidence_not_found: "Evidence was not found. Refresh the file list.",
+  memory_invalid: "Check the card fields, family requirements and schema dependencies.",
+  memory_forbidden: "Memory administration is not permitted.",
+  memory_not_found: "This Memory card or pending update no longer exists in the workspace.",
+  memory_conflict: "A linked card is missing or invalid. Review the links and retry.",
+  memory_unavailable: "The Memory archive is unavailable. Check the installation connection and migrations, then retry.",
   auth_forbidden: "Access is not permitted.",
   auth_invalid_credentials: "Invalid username or password.",
   auth_not_authorized: "Access is not permitted.",