feat: Phase 3b — proper Web UI for memories, projects, settings

Replaces the debug /me + /connect pages with a real authed app shell.

Pages
- /                       — anonymous landing; redirects to /dashboard once signed in
- /dashboard              — recent memories + top projects, quick "new memory" action
- /memories               — searchable list with hybrid (vector+FTS+tags) scoring;
                            per-result rank breakdown shown inline
- /memories/[id]          — view + inline edit toggle + delete
- /memories/new           — create form with project autocomplete
- /projects               — list with memory counts and last-activity
- /projects/[key]         — that project's memories
- /settings               — read-only Authentik profile + link to tokens
- /settings/tokens        — list / create / revoke CLI tokens

Old URLs preserved as redirects:
- /me      → /dashboard
- /connect → /settings/tokens

Stack additions
- Tailwind v4 with CSS-first @theme tokens (dark only for now)
- App shell in app/(authed)/ — auth guard + top nav with global search box
- Lightweight UI primitives in app/_components/ui/ (Button, Input, Card,
  Badge, EmptyState, Container, PageHeader)
- Search logic extracted from MCP tool into lib/memories.ts so Web UI and
  MCP both call the same RRF code path
- Memory CRUD via Server Actions in lib/memory-actions.ts; audit_log
  rows are tagged actor='web' to distinguish from MCP writes

Per-token revoke
- New cli_tokens table (id, user_id, jti unique, name, created_at,
  last_used_at, expires_at, revoked_at) — migration 0001_cli_tokens.sql
- mintCliToken now records jti + name; verifyCliToken enforces revocation
  for tracked tokens. Legacy tokens minted before this change (no jti)
  are accepted on signature alone until they expire naturally.
- /settings/tokens lists active + revoked tokens with one-click revoke

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/(authed)/memories/[id]/page.tsx

@@ -0,0 +1,142 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { and, eq, isNull } from "drizzle-orm";
+import { auth } from "@/auth";
+import { db } from "@/lib/db/client";
+import { memories, projects } from "@/lib/db/schema";
+import { updateMemoryAction, deleteMemoryAction } from "@/lib/memory-actions";
+import { Container, PageHeader } from "@/app/_components/ui/container";
+import { Card, CardBody, CardHeader } from "@/app/_components/ui/card";
+import { Input, Textarea, Label } from "@/app/_components/ui/input";
+import { Button } from "@/app/_components/ui/button";
+import { Badge } from "@/app/_components/ui/badge";
+
+export const dynamic = "force-dynamic";
+
+export default async function MemoryDetailPage({
+  params,
+  searchParams,
+}: {
+  params: Promise<{ id: string }>;
+  searchParams: Promise<{ edit?: string }>;
+}) {
+  const session = await auth();
+  const userId = session!.user.id;
+  const { id } = await params;
+  const { edit } = await searchParams;
+
+  const rows = await db
+    .select({
+      id: memories.id,
+      scope: memories.scope,
+      content: memories.content,
+      tags: memories.tags,
+      createdAt: memories.createdAt,
+      updatedAt: memories.updatedAt,
+      projectKey: projects.key,
+      projectId: memories.projectId,
+    })
+    .from(memories)
+    .leftJoin(projects, eq(memories.projectId, projects.id))
+    .where(
+      and(eq(memories.id, id), eq(memories.userId, userId), isNull(memories.deletedAt)),
+    )
+    .limit(1);
+
+  const m = rows[0];
+  if (!m) notFound();
+
+  const isEditing = edit === "1";
+
+  return (
+    <Container className="pt-6 max-w-3xl">
+      <PageHeader
+        title={isEditing ? "Edit memory" : "Memory"}
+        description={<span className="font-mono text-xs text-fg-subtle">{m.id}</span>}
+        actions={
+          <>
+            <Link href="/memories" className="no-underline">
+              <Button type="button" variant="secondary">Back</Button>
+            </Link>
+            {!isEditing ? (
+              <Link href={`/memories/${m.id}?edit=1`} className="no-underline">
+                <Button>Edit</Button>
+              </Link>
+            ) : null}
+          </>
+        }
+      />
+
+      <Card className="mb-4">
+        <CardHeader className="flex items-center gap-2 text-xs text-fg-muted">
+          <Badge tone={m.scope === "user" ? "accent" : "neutral"}>{m.scope}</Badge>
+          {m.projectKey ? <span className="font-mono">{m.projectKey}</span> : null}
+          <span>· Created {new Date(m.createdAt).toLocaleString()}</span>
+          {m.updatedAt.getTime() !== m.createdAt.getTime() ? (
+            <span>· Updated {new Date(m.updatedAt).toLocaleString()}</span>
+          ) : null}
+        </CardHeader>
+
+        {isEditing ? (
+          <CardBody>
+            <form action={updateMemoryAction} className="space-y-4">
+              <input type="hidden" name="id" value={m.id} />
+              <div>
+                <Label htmlFor="content">Content</Label>
+                <Textarea
+                  id="content"
+                  name="content"
+                  required
+                  rows={12}
+                  defaultValue={m.content}
+                  className="mt-1"
+                />
+              </div>
+              <div>
+                <Label htmlFor="tags" hint="comma- or space-separated">Tags</Label>
+                <Input
+                  id="tags"
+                  name="tags"
+                  defaultValue={m.tags.join(", ")}
+                  className="mt-1"
+                />
+              </div>
+              <div className="flex justify-end gap-2 pt-2">
+                <Link href={`/memories/${m.id}`} className="no-underline">
+                  <Button type="button" variant="secondary">Cancel</Button>
+                </Link>
+                <Button type="submit">Save changes</Button>
+              </div>
+            </form>
+          </CardBody>
+        ) : (
+          <CardBody>
+            <pre className="whitespace-pre-wrap break-words bg-transparent border-0 p-0 text-sm text-fg leading-relaxed">
+              {m.content}
+            </pre>
+            {m.tags.length ? (
+              <div className="flex gap-1 flex-wrap mt-4">
+                {m.tags.map((t) => (
+                  <Badge key={t}>{t}</Badge>
+                ))}
+              </div>
+            ) : null}
+          </CardBody>
+        )}
+      </Card>
+
+      {!isEditing ? (
+        <form
+          action={deleteMemoryAction}
+          onSubmit={() => undefined}
+          className="flex justify-end"
+        >
+          <input type="hidden" name="id" value={m.id} />
+          <Button type="submit" variant="danger" size="sm">
+            Delete memory
+          </Button>
+        </form>
+      ) : null}
+    </Container>
+  );
+}