feat(MAT-107): memory encryption & user isolation

- Per-user Fernet encryption for fact/chunk_text/summary fields
- Postgres RLS with memory_app restricted role
- SSL for memory-db connections
- Data migration script (migrate_encrypt.py)
- DB migration (migrate_rls.sql)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

memory-service/requirements.txt

@@ -3,3 +3,4 @@ uvicorn>=0.34,<1.0
 asyncpg>=0.30,<1.0
 pgvector>=0.3,<1.0
 httpx>=0.27,<1.0
+cryptography>=44.0,<45.0