Merge Phase 9: Memory + layered system prompt

Brings in the design docs for Phases 9-14, the revised Phase 9
design after the pre-implementation audit, and the full
implementation of Phase 9 (memory) plus the four-layer
system-prompt assembly that the architecture doc has been
describing aspirationally.

Both new features are gated by org_settings switches that default
in opposite directions:
- use_layered_prompt defaults true (assembly active immediately).
- allow_memory defaults false (memory only activates when an admin
  opts in via Admin -> Policy).

Migration 0022_user_memories.sql ships with the table, triggers
(touch_updated_at, 10-pin cap), RLS, and four new org_settings
columns with CHECK constraints. The migration runner applies it
on backend boot.

No behaviour changes for end users until the admin turns memory
on. The layered prompt is functionally equivalent to the legacy
SYSTEM_PROMPT for an account with no workspace instructions, no
user custom instructions, and no memories - which is everyone on
day one.