feat: Phase 3b — proper Web UI for memories, projects, settings

Replaces the debug /me + /connect pages with a real authed app shell.

Pages
- /                       — anonymous landing; redirects to /dashboard once signed in
- /dashboard              — recent memories + top projects, quick "new memory" action
- /memories               — searchable list with hybrid (vector+FTS+tags) scoring;
                            per-result rank breakdown shown inline
- /memories/[id]          — view + inline edit toggle + delete
- /memories/new           — create form with project autocomplete
- /projects               — list with memory counts and last-activity
- /projects/[key]         — that project's memories
- /settings               — read-only Authentik profile + link to tokens
- /settings/tokens        — list / create / revoke CLI tokens

Old URLs preserved as redirects:
- /me      → /dashboard
- /connect → /settings/tokens

Stack additions
- Tailwind v4 with CSS-first @theme tokens (dark only for now)
- App shell in app/(authed)/ — auth guard + top nav with global search box
- Lightweight UI primitives in app/_components/ui/ (Button, Input, Card,
  Badge, EmptyState, Container, PageHeader)
- Search logic extracted from MCP tool into lib/memories.ts so Web UI and
  MCP both call the same RRF code path
- Memory CRUD via Server Actions in lib/memory-actions.ts; audit_log
  rows are tagged actor='web' to distinguish from MCP writes

Per-token revoke
- New cli_tokens table (id, user_id, jti unique, name, created_at,
  last_used_at, expires_at, revoked_at) — migration 0001_cli_tokens.sql
- mintCliToken now records jti + name; verifyCliToken enforces revocation
  for tracked tokens. Legacy tokens minted before this change (no jti)
  are accepted on signature alone until they expire naturally.
- /settings/tokens lists active + revoked tokens with one-click revoke

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/(authed)/projects/[key]/page.tsx

@@ -0,0 +1,121 @@
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { and, desc, eq, isNull } from "drizzle-orm";
+import { auth } from "@/auth";
+import { db } from "@/lib/db/client";
+import { memories, projects } from "@/lib/db/schema";
+import { Container, PageHeader } from "@/app/_components/ui/container";
+import { Card, CardBody } from "@/app/_components/ui/card";
+import { Badge } from "@/app/_components/ui/badge";
+import { Button } from "@/app/_components/ui/button";
+import { EmptyState } from "@/app/_components/ui/empty-state";
+
+export const dynamic = "force-dynamic";
+
+export default async function ProjectDetailPage({
+  params,
+}: {
+  params: Promise<{ key: string }>;
+}) {
+  const session = await auth();
+  const userId = session!.user.id;
+  const { key: rawKey } = await params;
+  const key = decodeURIComponent(rawKey);
+
+  const projectRow = await db
+    .select()
+    .from(projects)
+    .where(and(eq(projects.userId, userId), eq(projects.key, key)))
+    .limit(1);
+  const project = projectRow[0];
+  if (!project) notFound();
+
+  const mem = await db
+    .select({
+      id: memories.id,
+      scope: memories.scope,
+      content: memories.content,
+      tags: memories.tags,
+      createdAt: memories.createdAt,
+    })
+    .from(memories)
+    .where(
+      and(
+        eq(memories.userId, userId),
+        eq(memories.projectId, project.id),
+        isNull(memories.deletedAt),
+      ),
+    )
+    .orderBy(desc(memories.createdAt))
+    .limit(100);
+
+  return (
+    <Container className="pt-6">
+      <PageHeader
+        title={project.displayName ?? project.key}
+        description={
+          <>
+            <span className="font-mono">{project.key}</span>
+            {" · "}
+            {mem.length} memor{mem.length === 1 ? "y" : "ies"}
+          </>
+        }
+        actions={
+          <>
+            <Link href="/projects" className="no-underline">
+              <Button type="button" variant="secondary">All projects</Button>
+            </Link>
+            <Link
+              href={`/memories/new?project=${encodeURIComponent(project.key)}`}
+              className="no-underline"
+            >
+              <Button>New in this project</Button>
+            </Link>
+          </>
+        }
+      />
+
+      {mem.length === 0 ? (
+        <EmptyState
+          title="No memories in this project yet"
+          description="Use the MCP from a Claude Code session, or create one here."
+          action={
+            <Link
+              href={`/memories/new?project=${encodeURIComponent(project.key)}`}
+              className="no-underline"
+            >
+              <Button>Create the first one</Button>
+            </Link>
+          }
+        />
+      ) : (
+        <ul className="space-y-2">
+          {mem.map((m) => (
+            <li key={m.id}>
+              <Link href={`/memories/${m.id}`} className="block no-underline">
+                <Card className="hover:border-border-strong transition-colors">
+                  <CardBody className="space-y-2">
+                    <div className="flex items-center gap-2 text-xs text-fg-subtle">
+                      <Badge tone={m.scope === "user" ? "accent" : "neutral"}>
+                        {m.scope}
+                      </Badge>
+                      <span>{new Date(m.createdAt).toLocaleString()}</span>
+                    </div>
+                    <p className="text-sm text-fg line-clamp-3">{m.content}</p>
+                    {m.tags.length ? (
+                      <div className="flex gap-1 flex-wrap">
+                        {m.tags.map((t) => (
+                          <Badge key={t}>{t}</Badge>
+                        ))}
+                      </div>
+                    ) : null}
+                  </CardBody>
+                </Card>
+              </Link>
+            </li>
+          ))}
+        </ul>
+      )}
+    </Container>
+  );
+}