personas: composite FK + built-in update guard

Two persona-infrastructure correctness fixes that go together because
the second one (FK with CASCADE) requires the first (preventing the
persona row from being mutated out from under its facts).

1. update_persona handler refuses name/systemPrompt edits to built-ins
   (409). includeAllMemories stays editable — that's a per-user
   preference, not the persona's identity. Mirrors the existing
   delete_persona guard. The DAO is intentionally permissive so the
   guard sits at the HTTP layer; persona_dao test pins that contract.

2. Migration 2026-05-10 adds user_id to entity_facts and a composite
   FK (user_id, persona_id) -> personas(user_id, persona_id) ON DELETE
   CASCADE. This closes two issues at once:

   - Persona orphans: deleting a custom persona used to leave its
     facts dangling forever, readable only via PersonaFilter::All.
     CASCADE now wipes them with the persona row.

   - Multi-user fact leakage: PersonaFilter::Single("default") used
     to surface every user's default-scoped facts. PersonaFilter is
     now { user_id, persona_id } and all read paths
     (get_facts_for_entity, list_facts, get_recent_activity) filter
     on user_id first. upsert_fact's dedup key extends to user_id so
     identical claims under shared persona names from different
     users no longer corroborate-bump each other's confidence.

   - user_id threads from Claims.sub.parse::<i32>().unwrap_or(1) at
     the chat / insight handlers through ChatTurnRequest, the
     streaming agentic loop, execute_tool, and into the leaf tools
     (tool_store_fact, tool_recall_facts_for_photo). The ".unwrap_or(1)"
     accommodates Apollo's service token whose sub is non-numeric on
     legacy mints.

   - Backfill picks the smallest user_id matching each legacy fact's
     persona_id so the FK holds for already-stored rows.

Five new knowledge_dao tests with FK-on connection: persona scoping
isolation, All-variant union per-user, dedup not crossing users,
CASCADE delete, FK rejection of unknown personas. Plus
dao_update_does_not_block_built_ins documenting where the
HTTP-layer guard lives.

Apollo coordinates separately — the matching changes there add the
/api/personas proxy and start sending persona_id on photo-chat turns.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ai/insight_chat.rs

@@ -31,6 +31,12 @@ pub type ChatLockMap = Arc<TokioMutex<HashMap<(i32, String), Arc<TokioMutex<()>>
 #[derive(Debug)]
 pub struct ChatTurnRequest {
     pub library_id: i32,
+    /// Author's user_id, extracted from Claims at the handler. Tagged
+    /// onto every entity_fact row written this turn so the composite FK
+    /// (user_id, persona_id) → personas holds and so cross-user reads
+    /// stay isolated. Service token claims that don't parse as i32
+    /// fall through to user_id=1 (operator convention).
+    pub user_id: i32,
     pub file_path: String,
     pub user_message: String,
     /// Override the model id. Local mode: an Ollama model name. Hybrid:
@@ -475,6 +481,7 @@ impl InsightChatService {
                             &ollama_client,
                             &image_base64,
                             &normalized,
+                            req.user_id,
                             &active_persona,
                             &loop_cx,
                         )
@@ -843,6 +850,7 @@ impl InsightChatService {
                 tools,
                 &image_base64,
                 &normalized,
+                req.user_id,
                 &active_persona,
                 max_iterations,
                 &tx,
@@ -1031,6 +1039,7 @@ impl InsightChatService {
                 tools,
                 &image_base64,
                 &normalized,
+                req.user_id,
                 &active_persona,
                 max_iterations,
                 &tx,
@@ -1181,6 +1190,7 @@ impl InsightChatService {
         tools: Vec<Tool>,
         image_base64: &Option<String>,
         normalized: &str,
+        user_id: i32,
         active_persona: &str,
         max_iterations: usize,
         tx: &tokio::sync::mpsc::Sender<ChatStreamEvent>,
@@ -1260,6 +1270,7 @@ impl InsightChatService {
                             ollama_client,
                             image_base64,
                             normalized,
+                            user_id,
                             active_persona,
                             &cx,
                         )