personas: composite FK + built-in update guard

Two persona-infrastructure correctness fixes that go together because
the second one (FK with CASCADE) requires the first (preventing the
persona row from being mutated out from under its facts).

1. update_persona handler refuses name/systemPrompt edits to built-ins
   (409). includeAllMemories stays editable — that's a per-user
   preference, not the persona's identity. Mirrors the existing
   delete_persona guard. The DAO is intentionally permissive so the
   guard sits at the HTTP layer; persona_dao test pins that contract.

2. Migration 2026-05-10 adds user_id to entity_facts and a composite
   FK (user_id, persona_id) -> personas(user_id, persona_id) ON DELETE
   CASCADE. This closes two issues at once:

   - Persona orphans: deleting a custom persona used to leave its
     facts dangling forever, readable only via PersonaFilter::All.
     CASCADE now wipes them with the persona row.

   - Multi-user fact leakage: PersonaFilter::Single("default") used
     to surface every user's default-scoped facts. PersonaFilter is
     now { user_id, persona_id } and all read paths
     (get_facts_for_entity, list_facts, get_recent_activity) filter
     on user_id first. upsert_fact's dedup key extends to user_id so
     identical claims under shared persona names from different
     users no longer corroborate-bump each other's confidence.

   - user_id threads from Claims.sub.parse::<i32>().unwrap_or(1) at
     the chat / insight handlers through ChatTurnRequest, the
     streaming agentic loop, execute_tool, and into the leaf tools
     (tool_store_fact, tool_recall_facts_for_photo). The ".unwrap_or(1)"
     accommodates Apollo's service token whose sub is non-numeric on
     legacy mints.

   - Backfill picks the smallest user_id matching each legacy fact's
     persona_id so the FK holds for already-stored rows.

Five new knowledge_dao tests with FK-on connection: persona scoping
isolation, All-variant union per-user, dedup not crossing users,
CASCADE delete, FK rejection of unknown personas. Plus
dao_update_does_not_block_built_ins documenting where the
HTTP-layer guard lives.

Apollo coordinates separately — the matching changes there add the
/api/personas proxy and start sending persona_id on photo-chat turns.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/knowledge.rs

@@ -14,8 +14,10 @@ use crate::personas::PersonaDaoData;
 /// Resolve the `X-Persona-Id` header into a `PersonaFilter`. Missing
 /// header → `'default'`. If the persona has `include_all_memories=true`,
 /// returns `PersonaFilter::All` so reads see the full hive-mind pool.
-/// On lookup failure (e.g. malformed JWT) returns `Single("default")` —
-/// safer than `All` because it preserves the historical baseline view.
+/// On JWT-parse failure (sub is not a numeric user_id) the resolver
+/// falls through to user_id=1 — the operator convention for service
+/// tokens — preserving the historical baseline view. Same fallback
+/// applies on any persona-lookup error.
 fn resolve_persona_filter(
     req: &HttpRequest,
     claims: &Claims,
@@ -28,15 +30,16 @@ fn resolve_persona_filter(
         .map(|s| s.to_string())
         .unwrap_or_else(|| "default".to_string());
 
-    let Ok(uid) = claims.sub.parse::<i32>() else {
-        return PersonaFilter::Single(pid);
-    };
+    let uid = claims.sub.parse::<i32>().unwrap_or(1);
 
     let cx = opentelemetry::Context::current();
     let mut dao = persona_dao.lock().expect("Unable to lock PersonaDao");
     match dao.get_persona(&cx, uid, &pid) {
-        Ok(Some(p)) if p.include_all_memories => PersonaFilter::All,
-        _ => PersonaFilter::Single(pid),
+        Ok(Some(p)) if p.include_all_memories => PersonaFilter::All { user_id: uid },
+        _ => PersonaFilter::Single {
+            user_id: uid,
+            persona_id: pid,
+        },
     }
 }