Harden standalone memory erasure

[Ayo-faks]

Summary

• add an authenticated standalone HTTP memory service backed by the existing PostgreSQL memory store
• add keyed, non-identifying scope/operation/audit tokens with durable erasure receipts, hard deletion, and anti-resurrection tombstones
• propagate MEMORY_TOMBSTONE_SECRET through runtime validation, deployment schemas, CLI surfaces, and examples
• make capture strategies honor erased scopes and preserve idempotent operation semantics while retaining current compare-and-set consolidation behavior

Test plan

• npm run typecheck
• npm run typecheck:contract
• scoped ESLint, oxlint, and Prettier checks over all 26 changed files
• 143 affected memory, config, HTTP service, secret-schema, async-capture, Docker, doctor, and Fly tests
• 111 AWS deployment tests
• 15 real-PostgreSQL memory tests, including hard erasure, capture-vs-erase races, anti-resurrection, key rotation fail-closed behavior, and integration-global operation tombstones
• independent fresh-context review of the staged diff
• rebased onto current main; conflict resolution retains upstream CAS-safe scratch promotion and MCP wiring

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}