feat(rbac): hierarchical access control with fine-grained scopes

Implements comprehensive RBAC system:

Core Types (types.rs):
- Role: named set of AccessRules
- AccessRule: (resources, verbs, scope) tuple
- AccessScope: project/visibility/owner/group constraints
- ResourceMeta: document metadata for access checks
- Verb: read/write/delete/query
- Visibility: public/private per document

Role Provider (role_provider.rs):
- RoleProvider trait for pluggable backends
- YamlRoleProvider: load from YAML files
- InMemoryRoleProvider: for testing
- CompositeRoleProvider: layered lookup
- Built-in roles: admin, portfolio-agent, authenticated-user

Scope Checker (scope_checker.rs):
- ScopeChecker trait + composite pattern
- ProjectScopeChecker: allowed projects list
- VisibilityScopeChecker: public/private matching
- OwnerScopeChecker: self/any/specific user
- GroupScopeChecker: required group membership

Access Guard (access_guard.rs):
- Unified API for HTTP + retrieval layers
- check_http_capability(): memory:read/write checks
- filter_resources(): document-level filtering
- Audit logging for all decisions

Tests: 77 unit + 25 integration, all passing

Migration note: AuthorizedPipeline retained for compatibility,
will be replaced by AccessGuard integration in next phase.

crates/mem-cli/src/lib.rs

@@ -27,6 +27,7 @@ pub mod result_compressor;
 pub mod federation;
 pub mod query_router;
 pub mod full_pipeline;
+pub mod authorized_pipeline;
 
 pub use endpoints::{IngestQueue, IngestRequest, JobStatus};
 pub use ingest_worker::IngestWorker;
@@ -39,3 +40,4 @@ pub use query_orchestrator::{QueryOrchestrator, QueryResult, OptimizedChunk, Que
 pub use query_filter::{QueryFilter, FilterableDocument, FilterEngine, FilterStatistics};
 pub use query_router::{QueryRouter, RouterConfig, RoutedResult, SelectedChunk, WikiGraphBuilder};
 pub use full_pipeline::{FullPipeline, PipelineConfig, PipelineResult, PipelineMetrics, EnrichedChunk, PipelineBuilder};
+pub use authorized_pipeline::{AuthorizedPipeline, AuthorizedPipelineBuilder, AuthorizedResult, AccessStats};