feat(rbac): wire AccessGuard into HTTP server and retrieval pipeline

HTTP Layer Integration:
- Add access_guard to AppState with builtin_role_provider
- Add to_rbac_claims() to convert JwtClaims → RBAC Claims
- Add query_result_to_resource_meta() for result filtering

Query Handler (/memory/query):
- RBAC filter applied after M3.8 optimization
- Batch check_access for all results
- Log filtered count per request

Context Handler (/memory/context):
- Project-level access check before lookup
- Return 403 if user lacks project access

Code Cleanup:
- Move http_server from bin to lib module
- Use mem_cli::http_server in main.rs

All 660+ tests passing.

crates/mem-cli/src/main.rs

@@ -1,5 +1,5 @@
 mod lessons_cmd;
-mod http_server;
+// http_server is in lib.rs, use mem_cli::http_server
 mod endpoints;
 mod ingest_worker;
 mod query_worker;
@@ -227,7 +227,7 @@ async fn main() -> anyhow::Result<()> {
         Commands::Serve { port, api_key, database_url } => {
             let api_key = api_key.unwrap_or_else(|| std::env::var("MEM_API_KEY").unwrap_or_else(|_| "test-key".to_string()));
             let database_url = database_url.unwrap_or_else(|| std::env::var("DATABASE_URL").unwrap_or_else(|_| "postgresql://app:poimen@localhost:5432/memory".to_string()));
-            http_server::start_server(port, api_key, &database_url).await?
+            mem_cli::http_server::start_server(port, api_key, &database_url).await?
         }
         Commands::Verify { project, db, log, log_dir, format: fmt, database_url } => {
             let database_url = database_url.unwrap_or_else(|| std::env::var("DATABASE_URL").unwrap_or_else(|_| "postgresql://app:poimen@localhost:5432/memory".to_string()));