feat: LLM entity + fact extraction pipeline (Zep paper alignment) (#48)

## Changes

### Entity Extraction
- Switch from WikiLinkFallbackExtractor to LlmEntityExtractor when LLM_ENDPOINT set
- `clean_llm_response()`: strips `<think>` tags, markdown fences, extracts JSON
- Handle array responses (Ollama returns `[...]` not `{entities: [...]}`)
- EntityType custom Deserialize: unknown variants → Unknown (no crash)
- Increase timeout 30s→90s, max_tokens 500→1500 for reasoning models
- Graceful reflection fallback: keep entities if verification fails

### Fact Extraction (NEW)
- LlmFactExtractor: LLM-based relationship extraction between entity pairs
- Validates source/target against known entity list (drops hallucinated edges)
- Same robust JSON cleaning for reasoning models + Ollama
- IngestWorker auto-selects LLM vs Simple based on LLM_ENDPOINT env

### K8s Deployment
- Add `command: ["/app/mem"]` (fix args replacing CMD)
- Add LLM_ENDPOINT, LLM_MODEL env vars for in-cluster LLM

## E2E Tested (local Ollama qwen2.5:3b)
- 12 entities extracted (person, tool, concept, organization)
- 5 edges with relationships and facts
- 781 tests pass

## Zep Paper Alignment (§2.2)
- Entity extraction + resolution (§2.2.1)
- Fact extraction between entity pairs (§2.2.2)
- Temporal edge invalidation ready (t_valid/t_invalid schema)
- Reflection verification (§2.2.1, graceful fallback)

---------

Co-authored-by: rock <[email protected]>
Reviewed-on: #48
Co-authored-by: poimen <[email protected]>

k8s/app/deployment.yaml

@@ -1,6 +1,6 @@
 # Poimen Memory API Server
-# Serves 7 HTTP endpoints for memory ingest, query, and management.
-# Connects to memory-db (pgvector) for persistent storage.
+# Serves HTTP endpoints for memory ingest, query, visualization.
+# Connects to memory-db (pgvector) + api.riotpiao.com (LLM via Authentik JWT).
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -60,13 +60,43 @@ spec:
                   key: password
             - name: DATABASE_URL
               value: "postgresql://$(DATABASE_USER):$(DATABASE_PASSWORD)@$(DATABASE_HOST):$(DATABASE_PORT)/$(DATABASE_NAME)?sslmode=disable"
-            # LLM Gateway API key
+
+            # LLM via api.riotpiao.com (Authentik JWT auth)
+            - name: LLM_ENDPOINT
+              value: "https://api.riotpiao.com/v1/chat/completions"
+            - name: LLM_API_BASE
+              value: "https://api.riotpiao.com/v1"
+            - name: LLM_MODEL
+              value: "ornith:35b"
+
+            # Authentik service account (memory-agent-oidc secret)
+            - name: AUTHENTIK_ISSUER
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: ISSUER
+            - name: AUTHENTIK_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: CLIENT_ID
+            - name: AUTHENTIK_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: CLIENT_SECRET
+            - name: TOKEN_URL
+              valueFrom:
+                secretKeyRef:
+                  name: memory-agent-oidc
+                  key: TOKEN_URL
+
+            # Server config
             - name: MEM_API_KEY
               valueFrom:
                 secretKeyRef:
                   name: poimen-memory-secrets
                   key: llm-api-key
-            # Server config (from ConfigMap)
             - name: MEM_PORT
               value: "8080"
             - name: MEM_HOME
@@ -74,10 +104,7 @@ spec:
           envFrom:
             - configMapRef:
                 name: poimen-memory-config
-            - secretRef:
-                name: poimen-memory-auth
-            - secretRef:
-                name: poimen-memory-secrets
+          command: ["/app/mem"]
           args:
             - serve
             - --port
@@ -110,7 +137,6 @@ spec:
         - name: tmp
           emptyDir:
             sizeLimit: 64Mi
-      # Tolerate control-plane nodes
       tolerations:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists