feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

harness/tests/test_evidence_authoring.py

@@ -350,12 +350,12 @@ def test_prepare_changed_source_uses_one_model_call_and_applies_a_valid_batch(tm
     assert restructurer.requests[0].previous_units[0].id == "evidence:fascia-pediatrica"
     curated_path = tmp_path / "evidence" / "curated" / "domain" / "fascia-pediatrica.md"
     curated = load_curated_tree(tmp_path / "evidence" / "curated")[0]
-    assert curated.schema_version == 3
+    assert curated.schema_version == 4
     assert "# Fascia pediatrica\n" in curated_path.read_text(encoding="utf-8")
     assert validate_workspace_evidence(tmp_path).publishable is True
 
 
-def test_migrate_workspace_evidence_rewrites_v1_units_as_v3_without_a_model_call(tmp_path):
+def test_migrate_workspace_evidence_rewrites_v1_units_as_v4_without_a_model_call(tmp_path):
     source_text = "I pazienti sotto i 18 anni sono pediatrici."
     _write_workspace(tmp_path, _evidence(source_text), source_text)
 
@@ -365,15 +365,16 @@ def test_migrate_workspace_evidence_rewrites_v1_units_as_v3_without_a_model_call
     migrated = load_curated_tree(tmp_path / "evidence" / "curated")[0]
     assert report.migrated == ("evidence:fascia-pediatrica",)
     assert report.unchanged == ()
-    assert migrated.schema_version == 3
+    assert migrated.schema_version == 4
     assert migrated.payload.rule == "La fascia pediatrica comprende i minori."
     text = curated_path.read_text(encoding="utf-8")
-    assert "## Regola\n\n<!-- tht:raw-rule:" in text
+    assert "## Regola\n\n" in text
+    assert "<!-- tht:" not in text
     assert "La fascia pediatrica comprende i minori." in text
     assert report.findings == ()
 
 
-def test_migrate_workspace_evidence_rewrites_v2_units_as_table_free_v3(tmp_path):
+def test_migrate_workspace_evidence_rewrites_v2_units_as_editable_v4(tmp_path):
     source_text = "I pazienti sotto i 18 anni sono pediatrici."
     evidence = _evidence(source_text).model_copy(update={"schema_version": 2})
     _write_workspace(tmp_path, evidence, source_text)
@@ -388,8 +389,8 @@ def test_migrate_workspace_evidence_rewrites_v2_units_as_table_free_v3(tmp_path)
     assert first.unchanged == ()
     assert second.migrated == ()
     assert second.unchanged == ("evidence:fascia-pediatrica",)
-    assert migrated.schema_version == 3
-    assert text.startswith("<!-- tht:metadata:")
+    assert migrated.schema_version == 4
+    assert text.startswith("---\nschema_version: 4")
     assert not any(line.startswith("|") for line in text.splitlines())
 
 
@@ -422,20 +423,24 @@ def test_migrate_workspace_evidence_rewrites_legacy_v3_rule_presentation(tmp_pat
     migrated_text = curated_path.read_text(encoding="utf-8")
     assert report.migrated == ("evidence:fascia-pediatrica",)
     assert report.unchanged == ()
-    assert "## Regola\n\n<!-- tht:raw-rule:" in migrated_text
+    assert "## Regola\n\n" in migrated_text
+    assert "<!-- tht:" not in migrated_text
     assert load_curated_tree(tmp_path / "evidence" / "curated")[0].payload.rule == (
         evidence.payload.rule
     )
 
 
-def test_migrate_workspace_evidence_rejects_dirty_curated_files_in_a_nested_workspace(tmp_path):
+def test_migrate_workspace_evidence_preserves_uncommitted_content_without_git_operations(tmp_path):
     subprocess.run(["git", "init", "--quiet", str(tmp_path)], check=True)
     workspace_root = tmp_path / "psd-clinical"
     source_text = "I pazienti sotto i 18 anni sono pediatrici."
     _write_workspace(workspace_root, _evidence(source_text), source_text)
 
-    with pytest.raises(EvidencePreparationError, match="authoring_worktree_dirty"):
-        migrate_workspace_evidence(workspace_root)
+    result = migrate_workspace_evidence(workspace_root)
+    assert result.migrated == ("evidence:fascia-pediatrica",)
+    assert load_curated_tree(workspace_root / "evidence/curated")[0].payload.rule == _evidence(source_text).payload.rule
+    assert subprocess.run(["git", "-C", str(tmp_path), "rev-parse", "HEAD"],
+                          capture_output=True, check=False).returncode != 0
 
 
 def test_prepare_can_issue_independent_source_calls_concurrently(tmp_path):
@@ -601,7 +606,7 @@ def test_prepare_marks_an_omitted_prior_unit_for_human_review(tmp_path):
         "supporting_excerpt_missing", "unresolved_review_item",
     ]
     retained = load_curated_tree(tmp_path / "evidence" / "curated")[0]
-    assert retained.schema_version == 3
+    assert retained.schema_version == 4
     assert retained.review_items[0].code == "source_no_longer_supports_unit"