feat: Phase 3b — proper Web UI for memories, projects, settings

Replaces the debug /me + /connect pages with a real authed app shell.

Pages
- /                       — anonymous landing; redirects to /dashboard once signed in
- /dashboard              — recent memories + top projects, quick "new memory" action
- /memories               — searchable list with hybrid (vector+FTS+tags) scoring;
                            per-result rank breakdown shown inline
- /memories/[id]          — view + inline edit toggle + delete
- /memories/new           — create form with project autocomplete
- /projects               — list with memory counts and last-activity
- /projects/[key]         — that project's memories
- /settings               — read-only Authentik profile + link to tokens
- /settings/tokens        — list / create / revoke CLI tokens

Old URLs preserved as redirects:
- /me      → /dashboard
- /connect → /settings/tokens

Stack additions
- Tailwind v4 with CSS-first @theme tokens (dark only for now)
- App shell in app/(authed)/ — auth guard + top nav with global search box
- Lightweight UI primitives in app/_components/ui/ (Button, Input, Card,
  Badge, EmptyState, Container, PageHeader)
- Search logic extracted from MCP tool into lib/memories.ts so Web UI and
  MCP both call the same RRF code path
- Memory CRUD via Server Actions in lib/memory-actions.ts; audit_log
  rows are tagged actor='web' to distinguish from MCP writes

Per-token revoke
- New cli_tokens table (id, user_id, jti unique, name, created_at,
  last_used_at, expires_at, revoked_at) — migration 0001_cli_tokens.sql
- mintCliToken now records jti + name; verifyCliToken enforces revocation
  for tracked tokens. Legacy tokens minted before this change (no jti)
  are accepted on signature alone until they expire naturally.
- /settings/tokens lists active + revoked tokens with one-click revoke

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/(authed)/_nav.tsx

@@ -0,0 +1,44 @@
+import Link from "next/link";
+import { Container } from "@/app/_components/ui/container";
+import { UserMenu } from "./_user-menu";
+import { SearchBox } from "./_search-box";
+import type { Session } from "next-auth";
+
+export function Nav({ user }: { user: Session["user"] }) {
+  return (
+    <header className="fixed top-0 inset-x-0 z-20 h-14 bg-surface-1/80 backdrop-blur border-b border-border">
+      <Container className="h-full flex items-center gap-4">
+        <Link
+          href="/memories"
+          className="flex items-center gap-2 text-fg font-semibold tracking-tight no-underline"
+        >
+          <span className="inline-block size-2 rounded-full bg-accent-400" />
+          shared-memory
+        </Link>
+
+        <nav className="hidden md:flex items-center gap-1 ml-2">
+          <NavLink href="/memories">Memories</NavLink>
+          <NavLink href="/projects">Projects</NavLink>
+          <NavLink href="/settings">Settings</NavLink>
+        </nav>
+
+        <div className="flex-1 max-w-md ml-auto">
+          <SearchBox />
+        </div>
+
+        <UserMenu user={user} />
+      </Container>
+    </header>
+  );
+}
+
+function NavLink({ href, children }: { href: string; children: React.ReactNode }) {
+  return (
+    <Link
+      href={href}
+      className="px-2.5 py-1.5 rounded-md text-sm text-fg-muted hover:text-fg hover:bg-surface-2 no-underline"
+    >
+      {children}
+    </Link>
+  );
+}