feat(memory): append-only audit log with history reads, revert, and undelete - #212

Expose the append-only memory_event log through a new read path across
every layer: a get_memory_history SQL function (read-gated per event
tree, nullable memoryId/tree/operation/operationId filters, bounded +
ordered), the memory.history RPC, engine store getMemoryHistory, the
client method, a `me memory history` CLI command (top-level alias `me
history`), and the me_memory_history MCP tool.

At least one scope (memoryId/tree/operationId) is required. Each event
is gated by read access to its own tree, so a moved memory's history may
be partial; deleted memories stay readable by id. Presentation trims the
snapshot via --select/select while always keeping the audit envelope
(who/when/what). Adds docs for the CLI command and MCP tool (+ nav), and
integration coverage for per-event-tree gating, filters/order, and the
end-to-end insert/update/delete → three-event history with the updater
preserved.

Make the audit log serve both a per-memory revision log and a
date-oriented activity feed, and reach deleted memories:

- Indexes: explicit (at desc) for the time feed (created outside the
  hypertable block so it exists with or without timescaledb), plus
  (operation_id) and (tree, name); keep (memory_id, version desc) for a
  future `me memory revert`. create_default_indexes => false.
- Retention: a 30-day drop_after policy on the hypertable (per-memory
  history is bounded to the window).
- get_memory_history gains since/until (chunk-pruned) and a keyset
  cursor on event_id (uuidv7 is unique and co-monotonic with `at`, so a
  single-column seek is exact — no timestamp-precision loss). The scope
  rule relaxes to memoryId | path | tree | operationId | since, enabling
  a space-wide since-based feed.
- resolve_memory_id_from_history + a `path` scope: memory.history
  resolves a path live-first, then via the log, so a deleted memory's
  history is reachable by its old path (live id wins on slot reuse).
- Result carries nextCursor. CLI gains --since/--until/--cursor and a
  "more:" hint; the MCP tool gains path/since/until/cursor. Docs updated.

The `(_since is null or e.at >= _since)` disjunction is opaque to
timescaledb chunk exclusion under a generic plan (the null branch
qualifies every row, so it isn't a bound on `at`). Normalize the bounds
once (`coalesce(_since, '-infinity')` / `coalesce(_until, 'infinity')`)
and compare directly — `e.at >= _since` / `e.at < _until`. That keeps
null-means-unbounded semantics while leaving a bare `at OP $param` qual
the constraint-aware Append prunes chunks with at executor startup.

Restore a memory's current state to a version-N snapshot from the audit
log, applied as a new forward version (a logged `revert` event) — not a
history rewrite. Full snapshot (content/meta/tree/name/temporal) is
restored, so a revert can move the memory back or hit a (tree, name)
CONFLICT; access requires write on the current and snapshot trees.

Undelete falls out of the same path: `memory_before_insert` no longer
forces version = 1 (ordinary inserts keep the column default), so
revert_memory re-inserts a deleted memory continuing BOTH sequences from
history — `version` (logical payload) and `content_version` (the
embedding-queue guard token). Continuing content_version matters: a reset
to 1 could collide with a pre-delete version still in flight in the
embedding worker, letting a stale embedding win the version-guarded
write-back. A deleted memory is reachable by its old path (via the log).

Deliberate override by default; optional expectedVersionHash guards a
concurrent change on a live memory (ME002). Retention still bounds which
versions are revertable. Adds memory.revert across protocol/engine/
server/client, `me memory revert <id-or-path> <version>` (TTY confirm,
top-level `me revert` alias), the me_memory_revert MCP tool, docs, and
migration + RPC integration coverage.