feat(routes)!: replace createMemory({ app }) with createMemoryRoutes

[TheGreatAxios]

Summary

Stacked on #52; merge that first.

• createMemoryRoutes({ memory, requireGrant, callerResolver? }) returns the memory routes as a Hono<TenantEnv> sub-app, with paths relative to the mount point. The host mounts it with app.route("/api/tenants/:tenantId/memory", …), the same shape as Interchange hub-api createGrantRoutes. Every route is guarded by deps.requireGrant.
• createMemory({ app }), CreateMemoryOptions and registerMemoryRoutes are removed. The one createMemory is the plane factory in memory.ts, and it builds its options as explicit literals.
• The package root exports only the public API. Internal services and helpers, the test fakes and resolveGrantConfig are gone from it. The distiller stays at @corbits/memory/distiller and migrations at @corbits/memory/migrations.
• MergeLocalLiveV1 no longer appears in shipped declarations.
• README, CHANGELOG and the root docs show the new mount.

Verification

• bun run typecheck, bun run build and bun test ./src pass (456 tests).
• grep -r MergeLocalLiveV1 dist finds nothing.
• The route tests mount createMemoryRoutes at /api/tenants/:tenantId/memory and pass.

Closes CL-9061
Closes CL-9316
Closes CL-9314
Closes CL-9128
Closes CL-9130
Closes CL-9134

[TheGreatAxios]

Self-review, three passes over the stacked range.

Verdict: ready for review.

• There is one createMemory. createMemoryRoutes returns a fresh Hono<TenantEnv> with relative paths, and the tests mount it the way the README shows.
• No conditional spreads remain in createMemory. The one spread left is the condition-registry key merge in resolveGrantConfig.
• The barrel is the public API only, and the built .d.ts files carry no MergeLocalLiveV1.
• Route authorization does not change when the host builds requireGrant from its own registry: share grants sit on memory.doc:<id>, not on the memory capability resource that the guard checks.