feat: Phase 3b — proper Web UI for memories, projects, settings

Replaces the debug /me + /connect pages with a real authed app shell.

Pages
- /                       — anonymous landing; redirects to /dashboard once signed in
- /dashboard              — recent memories + top projects, quick "new memory" action
- /memories               — searchable list with hybrid (vector+FTS+tags) scoring;
                            per-result rank breakdown shown inline
- /memories/[id]          — view + inline edit toggle + delete
- /memories/new           — create form with project autocomplete
- /projects               — list with memory counts and last-activity
- /projects/[key]         — that project's memories
- /settings               — read-only Authentik profile + link to tokens
- /settings/tokens        — list / create / revoke CLI tokens

Old URLs preserved as redirects:
- /me      → /dashboard
- /connect → /settings/tokens

Stack additions
- Tailwind v4 with CSS-first @theme tokens (dark only for now)
- App shell in app/(authed)/ — auth guard + top nav with global search box
- Lightweight UI primitives in app/_components/ui/ (Button, Input, Card,
  Badge, EmptyState, Container, PageHeader)
- Search logic extracted from MCP tool into lib/memories.ts so Web UI and
  MCP both call the same RRF code path
- Memory CRUD via Server Actions in lib/memory-actions.ts; audit_log
  rows are tagged actor='web' to distinguish from MCP writes

Per-token revoke
- New cli_tokens table (id, user_id, jti unique, name, created_at,
  last_used_at, expires_at, revoked_at) — migration 0001_cli_tokens.sql
- mintCliToken now records jti + name; verifyCliToken enforces revocation
  for tracked tokens. Legacy tokens minted before this change (no jti)
  are accepted on signature alone until they expire naturally.
- /settings/tokens lists active + revoked tokens with one-click revoke

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/(authed)/projects/page.tsx

@@ -0,0 +1,77 @@
+import Link from "next/link";
+import { and, desc, eq, isNull, sql } from "drizzle-orm";
+import { auth } from "@/auth";
+import { db } from "@/lib/db/client";
+import { memories, projects } from "@/lib/db/schema";
+import { Container, PageHeader } from "@/app/_components/ui/container";
+import { Card } from "@/app/_components/ui/card";
+import { Badge } from "@/app/_components/ui/badge";
+import { EmptyState } from "@/app/_components/ui/empty-state";
+
+export const dynamic = "force-dynamic";
+
+export default async function ProjectsPage() {
+  const session = await auth();
+  const userId = session!.user.id;
+
+  const rows = await db
+    .select({
+      id: projects.id,
+      key: projects.key,
+      displayName: projects.displayName,
+      createdAt: projects.createdAt,
+      memoryCount: sql<number>`count(${memories.id})::int`,
+      lastActivity: sql<Date | null>`max(${memories.createdAt})`,
+    })
+    .from(projects)
+    .leftJoin(
+      memories,
+      and(eq(memories.projectId, projects.id), isNull(memories.deletedAt)),
+    )
+    .where(eq(projects.userId, userId))
+    .groupBy(projects.id)
+    .orderBy(desc(sql`max(${memories.createdAt})`));
+
+  return (
+    <Container className="pt-6">
+      <PageHeader
+        title="Projects"
+        description={`${rows.length} project${rows.length === 1 ? "" : "s"}.`}
+      />
+
+      {rows.length === 0 ? (
+        <EmptyState
+          title="No projects yet"
+          description="Projects are created automatically the first time you write a project-scoped memory or call project.identify from the MCP."
+        />
+      ) : (
+        <Card>
+          {rows.map((p, i) => (
+            <Link
+              key={p.id}
+              href={`/projects/${encodeURIComponent(p.key)}`}
+              className={`block px-4 py-3 hover:bg-surface-2 no-underline ${i > 0 ? "border-t border-border" : ""}`}
+            >
+              <div className="flex items-center gap-3">
+                <div className="min-w-0 flex-1">
+                  <div className="flex items-center gap-2">
+                    <span className="font-mono text-sm text-fg truncate">{p.key}</span>
+                    <Badge>{p.memoryCount}</Badge>
+                  </div>
+                  {p.displayName && p.displayName !== p.key ? (
+                    <div className="text-xs text-fg-muted truncate mt-0.5">{p.displayName}</div>
+                  ) : null}
+                </div>
+                <div className="text-xs text-fg-subtle whitespace-nowrap">
+                  {p.lastActivity
+                    ? `last write ${new Date(p.lastActivity).toLocaleDateString()}`
+                    : "empty"}
+                </div>
+              </div>
+            </Link>
+          ))}
+        </Card>
+      )}
+    </Container>
+  );
+}