feat: Phase 2 — embeddings + hybrid memory.search

Adds a small embedder sidecar (Xenova/bge-small-en-v1.5, ONNX, CPU-only)
that the web app calls inline on memory.write and memory.update, and on
demand from the new memory.search tool.

memory.search performs three candidate fetches in parallel — pgvector
cosine similarity, Postgres full-text via plainto_tsquery + ts_rank_cd,
and tag-set overlap — then fuses them with Reciprocal Rank Fusion
(k=60). Each result carries its per-source rank so the model can see
*why* a memory surfaced.

The migrator boot step gained an idempotent embedding backfill: any row
with embedding IS NULL is batched (32 at a time) through the embedder
after SQL migrations apply. Safe to run on every boot.

New tool memory.update fixes the missing edit path; centralises the
re-embed-on-content-change rule alongside write.

Stack additions:
- apps/embedder/ — Fastify server, persistent /data/models volume so the
  ~30 MB model only downloads once
- apps/web/lib/embedder.ts — typed HTTP client with batched embed +
  health probe
- packages/schemas — MemoryUpdateInput, MemorySearchInput
- docker-compose — embedder service, healthcheck, app + migrator both
  depend_on it healthy; EMBEDDER_URL promoted to a required env var

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/embedder/Dockerfile

@@ -0,0 +1,62 @@
+# syntax=docker/dockerfile:1.7
+# -----------------------------------------------------------------------------
+# Embedder sidecar.
+#
+# Builds from the repo root: docker build -f apps/embedder/Dockerfile .
+# -----------------------------------------------------------------------------
+
+FROM node:20-alpine AS base
+RUN corepack enable
+WORKDIR /app
+
+# ---------- deps ----------
+FROM base AS deps
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc ./
+COPY apps/embedder/package.json ./apps/embedder/
+# Other workspace package.json files needed so pnpm install can resolve the
+# workspace before --filter narrows things down.
+COPY apps/web/package.json ./apps/web/
+COPY packages/schemas/package.json ./packages/schemas/
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile --filter @shared-memory/embedder...
+
+# ---------- builder ----------
+FROM base AS builder
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app/apps/embedder/node_modules ./apps/embedder/node_modules
+COPY . .
+
+# Compile TS to JS.
+RUN cd apps/embedder \
+ && pnpm exec tsc -p tsconfig.json --noEmit false --outDir dist
+
+# Prune devDependencies so the runtime image only ships production deps.
+RUN cd apps/embedder \
+ && pnpm install --prod --frozen-lockfile --filter @shared-memory/embedder...
+
+# ---------- runner ----------
+FROM node:20-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production \
+    PORT=8080 \
+    HOST=0.0.0.0 \
+    MODEL_CACHE_DIR=/data/models
+
+RUN apk add --no-cache wget \
+ && addgroup --system --gid 1001 nodejs \
+ && adduser  --system --uid 1001 --ingroup nodejs node-embedder \
+ && mkdir -p /data/models \
+ && chown -R node-embedder:nodejs /data
+
+COPY --from=builder --chown=node-embedder:nodejs /app/apps/embedder/dist            ./dist
+COPY --from=builder --chown=node-embedder:nodejs /app/apps/embedder/node_modules    ./node_modules
+COPY --from=builder --chown=node-embedder:nodejs /app/apps/embedder/package.json    ./package.json
+
+USER node-embedder
+EXPOSE 8080
+VOLUME ["/data/models"]
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=120s --retries=5 \
+  CMD wget -q -O - http://127.0.0.1:8080/health | grep -q '"ready":true' || exit 1
+
+CMD ["node", "--enable-source-maps", "dist/index.js"]