feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

harness/tht/evidence/corpus/models.py

@@ -8,7 +8,12 @@ from typing import Self
 
 from pydantic import BaseModel, ConfigDict, Field, JsonValue, field_validator, model_validator
 
-from tht.evidence.canonical import EVIDENCE_KINDS, EVIDENCE_PURPOSES
+from tht.evidence.canonical import (
+    EVIDENCE_KINDS,
+    EVIDENCE_PURPOSES,
+    EvidenceProvenance,
+    ManualEvidenceProvenance,
+)
 from tht.evidence.contracts import (
     canonical_provenance_uri,
     normalize_aware_datetime,
@@ -76,10 +81,10 @@ def _validate_evidence_metadata(metadata: Mapping[str, JsonValue]) -> None:
     if not isinstance(metadata["language"], str) or not metadata["language"]:
         raise ValueError("typed Evidence metadata must contain language")
     provenance = metadata["provenance"]
-    if not isinstance(provenance, dict) or set(provenance) != {
-        "source_file", "source_sha256", "supporting_excerpts",
-    }:
-        raise ValueError("typed Evidence metadata must contain canonical provenance")
+    if not isinstance(provenance, dict):
+        raise ValueError("typed Evidence metadata must contain canonical provenance")  # noqa: TRY004
+    model = ManualEvidenceProvenance if provenance.get("kind") == "manual" else EvidenceProvenance
+    model.model_validate(provenance)
 
 
 class _CanonicalValue(BaseModel):