feat(memoria): add consented ad personalization

[juemimgcd]

Summary

• add an owner-scoped, JWT-protected ad reranking endpoint that only uses active low-sensitivity preference memories after explicit consent
• persist canonical memory sensitivity and independently ordered ad-personalization settings through the durable outbox/event path
• return deterministic business-score fallback results when consent, eligible memory, or embeddings are unavailable
• document privacy and ownership boundaries, and support Apple Silicon Docker builds plus existing embedding environment names

Validation

• Docker Compose image build completed on Apple Silicon, including the frontend production build
• Mneme health endpoint returned healthy
• Memoria readiness and worker diagnostics returned ready with one worker and zero backlog
• Mneme migration: 20260719_01 (head)
• Memoria migration: 20260830_01 (head)
• runtime OpenAPI contained POST /v1/ad-recommendations
• python -m compileall -q app main.py
• python -m ruff check --no-cache app main.py tests
• python -m pytest -q -p no:cacheprovider -m "not integration": 345 passed, 2 deselected, 8 subtests passed
• git diff --check
• project containers stopped after validation; images and volumes preserved

Notes

• no test files or test cases were added or modified
• personalization remains disabled by default
• callers remain responsible for campaign, inventory, budget, geographic, and frequency eligibility