feat(ks): let Rose agents and workflows change K&S matters

13 write tools: tasks, assignments, time, calendar, matter fields and matter
documents. All in WRITE_TOOLS, so any agent plan containing one stops at the
approval gate; drafting gets the full set, intake gets create-only, and
research/review/verify stay read-only.

The backend runs as service-role so RLS does not apply - every path enforces
scope itself. The shared teaching matter is append-only: anyone may add to
NexaCare, only the creator may change or delete, and the guard fails closed
because all 49 seeded tasks have performed_by null. That keeps the Week-9
evidence base reproducible for all six groups. ks_update_matter refuses the
shared matter outright, since matter-level fields are not row-owned.

Fixes a break found in verification: created_by/uploaded_by/assigned_to and
the various user_id columns reference ks.profiles (the personas), not
auth.users. The first version stamped the student's auth id into created_by,
which would have failed the foreign key on every task create.

Verified live: append allowed, seeded row blocked, own row allowed, and a
3h @ $600 entry moved matter fees 151,615 -> 153,415 and back with no
residue, confirming the recompute triggers fire from these writes.