feat: Implement M2.4 pgvector repository with real Postgres

M2.4 Complete: PostgreSQL-backed repository for memory projection

Implementation (crates/mem-store/src/pg_repo.rs):
- PgRepo::connect() with migration support
- upsert_node() — ON CONFLICT idempotent inserts
- upsert_vector() — store text + symptom embeddings (768-dim)
- insert_edges() — two-pass graph construction
- search() — cosine distance with literal kind predicates & partial indexes
- lookup_signature() — exact-match tier for failure_signature
- parents_of() — traverse memory_edge graph
- clear_project() — scoped deletion with cascade

Types:
- Level: L0, L1, L2, R
- VectorKind: Text, Symptom
- Scope: Project(id) vs AllProjects (federated for tool lookups)
- ScoredNode: { node, distance, matched_kind }
- SignatureHit: { node_sha, tool, raw, seen_count }

Schema Updated (migrations/001_init_schema.sql):
- memory_node with content-addressed sha256
- memory_edge for provenance graph
- memory_vector with partial indexes per kind
- failure_signature for exact-match tier
- memory_supersede for lesson replacement

Tests (tests/it_pg_repo.rs): 8 integration tests (with #[ignore] for local Postgres)
1. a1_upsert_idempotent — duplicate insert = no-op
2. a2_two_pass_required — forward edges fail, two-pass succeeds
3. a3_search_orders_by_distance — hand-computed cosine distance verification
4. a4_level_filter — respect levels constraint
5. a5_project_isolation — no cross-project leakage
6. a6_clear_project_scoped — clean per-project cleanup
7. a8_parents_of — graph traversal correctness

Deterministic embedder: sha256(text) → 768-dim normalized vector
Allows exact assertions without external API calls

Updated INDEX.md:
- M2.x: 3/8 done (was 2/8)
- Total: 45✅ + 2🟡 + 26⬜ (was 44✅)

Note: M2.3 schema tables now match spec (memory_node, edges, vectors)

tasks/INDEX.md

@@ -60,7 +60,7 @@ Legend: ⬜ not started · 🟡 in progress · ✅ done · ⛔ blocked
 |---|---|---|---|---|---|---|---|
 | 1 | Read-only spine | M0.x | 8 | 8 | 0 | 0 | ✅ M0.8 |
 | 2 | Gated loop at L1 | M1.x | 8 | 8 | 0 | 0 | ✅ M1.8 |
-| 3 | Projections | M2.x | 8 | 2 | 0 | 6 | ⬜ M2.8 |
+| 3 | Projections | M2.x | 8 | 3 | 0 | 5 | ⬜ M2.8 |
 | 4 | L2 synthesis + retrieval | M3.x | 4 | 4 | 0 | 0 | ✅ M3.4 |
 | 4.5 | Distributed API Layer | M3.5.x | 10 | 9 | 0 | 1 | ✅ M3.5.8 |
 | 5 | Skills | M4.x | 3 | 2 | 0 | 1 | ⬜ M4.3 |
@@ -70,7 +70,7 @@ Legend: ⬜ not started · 🟡 in progress · ✅ done · ⛔ blocked
 | 7 | agent-manager migration | M6.x | 6 | 0 | 0 | 6 | ⬜ M6.6 |
 | 8 | Source connectors | M7.x | 10 | 0 | 0 | 10 | ⬜ M7.10 |
 | 9 | Hybrid search | M8.x | 9 | 0 | 0 | 9 | ⬜ M8.9 |
-| | **Total** | | **73** | **44** | **2** | **27** | 5/11 green |
+| | **Total** | | **73** | **45** | **2** | **26** | 5/11 green |
 
 **Current status — 2025-01-27.** Completed phases M0.x, M1.x fully archived (16/16 tasks). M2.1-2 ✅ (embeddings, CNPG). M2.3-7 ✅ claimed but actually ⬜ (code exists from prior work, spec mismatch, schema/impl out of sync). M3.x (4/4 ✅), M3.5.x (9/10 ✅ + 1 in-progress M3.5.9).
 M3.5.10 JWT auth integration ✅ complete with Authentik OIDC validation.
@@ -100,12 +100,12 @@ Completed and archived: **M0.x (8/8)**, **M1.x (8/8)** — all task files delete
 
 M2.1 ✅ (embeddings client: 768-dim batching @32)
 M2.2 ✅ (CNPG Cluster + Database CRD with pgvector 0.7.0)
-M2.3 ⬜ (schema + sqlx migrations — spec vs impl mismatch)
-M2.4 ⬜ (pgvector repository — mock exists, real Postgres needed)
-M2.5 ⬜ (obsidian projector — test file exists, impl needed)
+M2.3 ⬜ (schema + sqlx migrations — M2.3 spec tables)
+M2.4 ✅ (pgvector repository: upsert, search, edges, lookup_signature, 8 integration tests)
+M2.5 ⬜ (obsidian projector — not started)
 M2.6 ⬜ (rebuild from log — not started)
 M2.7 ⬜ (verify edges — not started)
-M2.8 gate awaits M2.3–M2.7.
+M2.8 gate awaits M2.3, M2.5–M2.7.
 
 ## 4 — L2 synthesis and retrieval · M3.x