feat(topic-memory): complete generic Artifact APIs

[Zxf-xufeng]

Which issue or RFC does this PR close?

Implements the design proposed in #1614. The RFC and implementation are intentionally separate draft PRs.

Rationale for this change

PR #1550 made Topic Memory readable through the generic Artifact APIs, but generic manual writes, tags, filtered listing, and complete cross-Scope publication were still unavailable. These operations must preserve the family's active head, immutable revisions, provenance, chunks, and configured search indexes as one consistent state.

What changes are included in this PR?

• Add strict Topic Memory Create/Replace request models and regenerate the Python HTTP contract and public exports.
• Prepare deterministic chunks and optional embeddings before the write transaction, with configured timeout/concurrency limits; atomically commit manual provenance, content, and retrieval projections through the family repository. Recheck ETags after preparation and at commit.
• Add Topic Memory tag reads/writes, mixed-family tag queries, and SQL-level all/any tag filtering before pagination. Bind normalized filters to signed cursors and preserve tags across content revisions.
• Publish exact historical revisions into an independent target identity with complete retrieval state. Preserve publication provenance, omit direct Sources and tags, and resolve completed retries before embedding. Concurrent requests create only one complete target.
• Apply Scope-level authorization, including administration of both Scopes for publication, without Artifact-owner hooks for Topic Memory.
• Upgrade the tag family CHECK constraint on startup: transactional SQLite table rebuild preserving rows, foreign keys and indexes; OceanBase constraint alteration.
• Add HTTP lifecycle, restart, access-control (builtin/Casbin), concurrent CAS/publication, inference timeout, index-failure rollback, and legacy-schema migration coverage.

Are there any user-facing changes?

Topic Memory gains the seven capabilities described in #1614. Manual input requires complete nonblank title/summary/detail and is not rewritten by a generation model. Vector deployments perform synchronous embedding before success. Replacing existing content or tags requires scope.admin; creation requires scope.contribute. Default tag queries now include Topic Memory.

Before upgrading existing databases, back up the database and pause old writers while the tag CHECK constraint is upgraded. Downgrades require evaluating compatibility with newly stored Topic Memory tags. No automatic repair of historically incomplete Topic Memory copies is attempted.

How was this change tested?

• make check: passed (integration manifest, lock consistency, pre-commit checks, Ruff, and both type-check targets).
• make contract-test: passed, 48 tests; generated Python and JavaScript API checks passed.
• pytest tests/e2e/test_topic_memory_generic_api.py -q: 9 passed, covering SQLite FTS and vector-enabled writes, history, tags, publication, restart, migration rollback, two-instance races, storage-failure atomicity, and configured inference timeout.
• Extended regression suite: 239 passed, 26 skipped. Covered generic API/access/tags/base access, Scope and Topic Memory server APIs, publication, Topic Memory persistence/integrity/application/processing, and the hermetic product chain.
• OceanBase/SeekDB integration cases require external test instances and were skipped. In particular, the OceanBase tag CHECK upgrade has not been verified against a live OceanBase instance.

Tests clear inherited local server authentication/dashboard settings and use temporary databases. Product-chain tests use loopback-only test services.

AI usage statement

OpenAI Codex assisted with codebase analysis, RFC translation, implementation, regression tests, and verification. The changes are submitted as a draft for maintainer review.

[Teingi]

LGTM