feat(rbac): wire AccessGuard into HTTP server and retrieval pipeline

HTTP Layer Integration:
- Add access_guard to AppState with builtin_role_provider
- Add to_rbac_claims() to convert JwtClaims → RBAC Claims
- Add query_result_to_resource_meta() for result filtering

Query Handler (/memory/query):
- RBAC filter applied after M3.8 optimization
- Batch check_access for all results
- Log filtered count per request

Context Handler (/memory/context):
- Project-level access check before lookup
- Return 403 if user lacks project access

Code Cleanup:
- Move http_server from bin to lib module
- Use mem_cli::http_server in main.rs

All 660+ tests passing.

IMPLEMENTATION_STATUS.md

@@ -2,9 +2,9 @@
 
 ## Summary
 
-**Status**: Phases 1-7 complete with hierarchical RBAC. 660+ tests passing.
+**Status**: Phases 1-7 complete with RBAC wired into HTTP + retrieval. 660+ tests passing.
 
-**Latest commit**: Hierarchical RBAC with fine-grained access control
+**Latest commit**: RBAC wired into HTTP server and retrieval pipeline
 
 ---
 
@@ -106,10 +106,17 @@
 - ✅ Built-in roles: `admin`, `portfolio-agent`, `authenticated-user`
 - ✅ 77 unit tests, 25 integration tests, all passing
 
-### AuthorizedPipeline (Legacy - to be replaced)
+### HTTP + Retrieval Integration
+- ✅ **AppState.access_guard**: AccessGuard added to HTTP server state
+- ✅ **to_rbac_claims()**: Convert JwtClaims to RBAC Claims
+- ✅ **query_handler**: RBAC filtering on search results
+- ✅ **context_handler**: Project-level access check before lookup
+- ✅ **query_result_to_resource_meta()**: Convert results for RBAC filtering
+
+### AuthorizedPipeline (Legacy - deprecated)
 - ✅ `AuthorizedPipeline`: wraps FullPipeline with access control
 - ✅ 13 unit tests, all passing
-- ⚠️ Will be replaced by `AccessGuard` integration
+- ⚠️ Superseded by AccessGuard integration in http_server.rs
 
 ---