fix: Authentik JWT scope + ornith:35b reasoning field + observability logs

Auth:
- Add scope=openid roles to token request (required for llm:inference)
- Derive TOKEN_URL from ISSUER or use TOKEN_URL env var
- Support both AUTHENTIK_* and memory-agent-oidc secret key names

ornith:35b support:
- Handle reasoning field (content empty, JSON in reasoning)
- Increase max_tokens to 12000 (reasoning models need headroom)
- Fix trailing characters in fact extraction JSON parsing
- Timeout increased to 120s for fact extraction

Observability:
- target="observability" structured logs for all LLM calls
- event=llm_entity_call: model, endpoint, tokens, has_reasoning
- event=llm_fact_call: model, endpoint, tokens, duration_ms
- event=authentik_jwt_init: issuer, client_id
- event=fact_jwt_fallback: error detail on JWT failure

Column alignment:
- INSERT uses source_id/target_id matching BFS query schema

E2E tested with ornith:35b via api.riotpiao.com:
- 6 entities, 4 edges with temporal facts
- All observability logs present

crates/mem-cli/src/ingest_worker.rs

@@ -207,7 +207,7 @@ async fn save_entity_to_db(pool: &PgPool, entity: &mem_core::entity::Entity) ->
 async fn save_edge_to_db(pool: &PgPool, edge: &mem_core::edge::Edge) -> Result<()> {
     // Try temporal schema first (id, project_id, source_entity_id, etc)
     let result = sqlx::query(
-        "INSERT INTO memory_edge (id, project_id, source_entity_id, target_entity_id, relation_type, fact, t_valid, t_invalid, t_created, confidence)
+        "INSERT INTO memory_edge (id, project_id, source_id, target_id, relation_type, fact, t_valid, t_invalid, t_created, confidence)
          VALUES ($1, $2, $3, $4, $5, $6, $7::TIMESTAMPTZ, $8::TIMESTAMPTZ, $9::TIMESTAMPTZ, $10)
          ON CONFLICT (id) DO NOTHING"
     )