feat: Phase 1 — Authentik auth, MCP endpoint, persistent memory

End-to-end Phase 1 of shared-memory: a logged-in Authentik user can sign
into the Web UI (/me debug page), and an MCP client with an Authentik-
issued bearer token can call memory.write / memory.list / memory.get /
memory.delete plus project.identify against /api/mcp.

Stack:
- Next.js 15 (App Router) + React 19 + TypeScript, pnpm workspaces
- Drizzle ORM + Postgres 16 + pgvector + pg_trgm
- Auth.js v5 with Authentik provider (Web UI)
- jose + Authentik JWKS for MCP bearer-token validation
- JSON-RPC 2.0 dispatcher implementing the MCP wire protocol over plain
  HTTP POST (hand-rolled to fit Next.js App Router; switches to SSE in a
  later phase if server-initiated events are needed)
- bge-small embeddings sidecar deferred to Phase 2; the schema already
  reserves the vector(384) column + IVFFlat index, FTS via a STORED
  tsvector column, and the visibility enum (private/shared/team) so
  cross-user memory sharing can be added without a future migration

Deployment supports two modes (set in .env, never committed):
- Behind an external reverse proxy (HAProxy / nginx / Cloudflare Tunnel /
  Traefik) — DEFAULT; the app exposes APP_PORT on the host with
  X-Forwarded-* trusted, no in-container TLS
- Built-in TLS via Caddy — opt-in with `docker compose --profile tls up`

Discovery endpoint at /.well-known/oauth-protected-resource (RFC 9728)
points MCP clients at the Authentik authorization server after a 401.

README walks through both Authentik providers (Web UI + MCP resource
server), the audience scope mapping, redirect URIs, and includes a worked
HAProxy config snippet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/scripts/migrate.ts

@@ -0,0 +1,65 @@
+/**
+ * Run pending SQL migrations from ./drizzle in lexical filename order.
+ *
+ * Lightweight runner — drizzle-kit's TS migrator doesn't handle the raw SQL
+ * features we need (pgvector, generated columns), so we manage migration
+ * state ourselves in `_migrations` and apply files as plain SQL.
+ */
+import { readFile, readdir } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import postgres from "postgres";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const MIGRATIONS_DIR = join(__dirname, "..", "drizzle");
+
+async function main() {
+  const url = process.env.DATABASE_URL;
+  if (!url) {
+    console.error("DATABASE_URL is not set");
+    process.exit(1);
+  }
+
+  const sql = postgres(url, { max: 1, prepare: false });
+
+  try {
+    await sql`
+      CREATE TABLE IF NOT EXISTS "_migrations" (
+        "id"          serial PRIMARY KEY,
+        "name"        text NOT NULL UNIQUE,
+        "applied_at"  timestamptz NOT NULL DEFAULT now()
+      )
+    `;
+
+    const files = (await readdir(MIGRATIONS_DIR))
+      .filter((f) => f.endsWith(".sql"))
+      .sort();
+
+    const applied = new Set(
+      (await sql<{ name: string }[]>`SELECT name FROM "_migrations"`).map((r) => r.name),
+    );
+
+    for (const file of files) {
+      if (applied.has(file)) {
+        console.log(`✓ ${file} (already applied)`);
+        continue;
+      }
+      const body = await readFile(join(MIGRATIONS_DIR, file), "utf8");
+      console.log(`→ ${file} (applying)`);
+      await sql.begin(async (tx) => {
+        await tx.unsafe(body);
+        await tx`INSERT INTO "_migrations" (name) VALUES (${file})`;
+      });
+      console.log(`✓ ${file}`);
+    }
+
+    console.log("Migrations complete.");
+  } finally {
+    await sql.end({ timeout: 5 });
+  }
+}
+
+main().catch((err) => {
+  console.error("Migration failed:", err);
+  process.exit(1);
+});