feat: implement agent memory with role-to-prompt mapping (Phase 6)

Complete database schema and API implementation for agent memory
aligned with API Platform Engineer role requirements
(agency-agents/engineering/engineering-api-platform-engineer.md)

Schema (migration 004):
  ✓ agent_prompt: template-based prompts with versioning
  ✓ agent_skill: capabilities with effectiveness tracking
  ✓ agent_decision: reasoning and outcome recording
  ✓ role_prompt_mapping: maps roles (e.g., api-platform-engineer) to prompts
  ✓ agent_metrics: performance tracking per agent
  ✓ prompt_usage_log: detailed invocation tracking
  ✓ agent_registry: agent lifecycle management

API Endpoints (contract-first, backward-compatible):
  POST   /memory/agents/{project_id}/prompts
  POST   /memory/agents/{project_id}/roles
  GET    /memory/agents/{project_id}/roles/{role_name}/prompts

Handlers:
  ✓ create_prompt_handler: persists to agent_prompt table
  ✓ map_role_to_prompt_handler: role → prompt mapping with priority
  ✓ get_role_prompts_handler: retrieves prompts by role

Repository Layer (mem-store/src/agent_repo.rs):
  ✓ AgentRepository with full CRUD operations
  ✓ Prompt usage tracking and statistics
  ✓ Role-to-prompt mapping with priority ordering
  ✓ Metrics persistence for observability

Tekton Pipeline:
  ✓ agent-memory-migration-task: applies schema migration
  ✓ verify-indexes: validates all indexes created
  ✓ verify-schemas: validates table structure
  ✓ integration into poimen-ci pipeline

Integration Tests (tests/agent_memory_api_platform_engineer.rs):
  ✓ Contract-first API specification validation
  ✓ Backward compatibility rule enforcement
  ✓ Rate limiting communication (X-RateLimit-* headers)
  ✓ Error response consistency (stable codes + request IDs)
  ✓ Deprecation lifecycle (announce → signal → runway → sunset)
  ✓ Idempotency and retry safety
  ✓ API Platform Engineer role requirements
  ✓ Agent prompt templates for contract review, compatibility check, SDK generation

All tests validate against agency-agents API Platform Engineer specification:
  - Contract-first: OpenAPI spec before code
  - No breaking changes without versioning
  - Consistent error handling (RFC 9457 problem details)
  - Rate limits communicated not enforced
  - SDKs + docs generated from spec
  - Idempotency via Idempotency-Key header
  - Deprecation with runway (6-12+ months)

Ready to deploy: run Tekton PipelineRun to apply migrations + test

k8s/tekton/agent-memory-pipelinerun.yaml

@@ -0,0 +1,76 @@
+---
+# PipelineRun: Agent Memory Feature Testing
+# Tests role-to-prompt mapping with API Platform Engineer role requirements
+# Runs migrations, integration tests, and validates all constraints
+
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  name: agent-memory-test-run
+  namespace: poimen
+  generateName: agent-memory-test-
+spec:
+  pipelineRef:
+    name: poimen-ci
+  
+  params:
+  - name: image
+    value: "forgejo.riotpiao.com/riotpiao-poimen/poimen-memory:latest"
+  - name: registry-user
+    value: "riotpiao-poimen"
+  - name: registry-token
+    value: "${FORGEJO_REGISTRY_TOKEN}"  # Injected by ArgoCD/SOPS
+  
+  workspaces:
+  - name: source
+    emptyDir: {}  # Or use PVC for persistent builds
+  
+  serviceAccountName: tekton-builder
+  
+  timeouts:
+    pipeline: "1h"
+    tasks: "30m"
+
+---
+# ServiceAccount for Tekton Pipeline (builder with DB access)
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tekton-builder
+  namespace: poimen
+
+---
+# ClusterRoleBinding: Allow pipeline to query database via pod exec
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: tekton-builder-db-access
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: tekton-builder-db-access
+subjects:
+- kind: ServiceAccount
+  name: tekton-builder
+  namespace: poimen
+
+---
+# ClusterRole: Database access for migrations
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: tekton-builder-db-access
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list"]
+- apiGroups: [""]
+  resources: ["pods/exec"]
+  verbs: ["create"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["memory-db-app"]
+  verbs: ["get"]
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["get", "list"]