security: enforce per-user data isolation in memory service

- Make user_id required on all request models with field validators
- Always include user_id in WHERE clause for chunk queries (prevents cross-user data leak)
- Add bearer token auth on all endpoints except /health
- Add composite index on (user_id, room_id) for conversation_chunks
- Bot: guard query_chunks with sender check, pass room_id, send auth token
- Docker: pass MEMORY_SERVICE_TOKEN to both bot and memory-service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -20,6 +20,7 @@ services:
       - LITELLM_API_KEY
       - DEFAULT_MODEL
       - MEMORY_SERVICE_URL=http://memory-service:8090
+      - MEMORY_SERVICE_TOKEN
       - PORTAL_URL
       - BOT_API_KEY
     volumes:
@@ -60,6 +61,7 @@ services:
       LITELLM_BASE_URL: ${LITELLM_BASE_URL}
       LITELLM_API_KEY: ${LITELLM_MASTER_KEY}
       EMBED_MODEL: ${EMBED_MODEL:-text-embedding-3-small}
+      MEMORY_SERVICE_TOKEN: ${MEMORY_SERVICE_TOKEN:-}
     depends_on:
       memory-db:
         condition: service_healthy