feat: SaaS foundation for CrowdSight

Elevate MiroFish/CrowdSight from single-container dev to a SaaS foundation:

- Local memory backend (Zep-compatible): memory services/models, local graph
  builder + updater, AgentActivity seam, import-boundary isolation; Zep stays
  default, local is opt-in behind MEMORY_BACKEND. Semantic parity not yet proven.
- Durable product persistence: projects/simulations/reports schema (migration
  0007) + tenant/owner-scoped ProductRepository + dual-write + scoped_project
  read-first + ArtifactStore abstraction; durable JobQueue + worker.py.
- SaaS hardening: durable RateLimiter (wired to login), UsageService (LLM
  accounting), redacted AuditService, idempotency, CORS allowlist, safe API
  errors, single-use PasswordResetService + endpoints (covers invite-pending).
- Exactly 3 roles (super_admin/admin/user) with tenant authz policy.
- Admin UI: GET/POST/PATCH /api/admin/users + GET/PUT /api/admin/settings
  (super-admin only, encrypted/masked); AdminView.vue + SettingsView.vue with
  admin/super-admin route guards, th/en i18n.
- Production deploy topology: multi-stage Dockerfile (frontend build + gunicorn
  wsgi + nginx SPA-proxy + supervisord worker), backend/wsgi.py, gunicorn dep.

Backend 197 passed; frontend 10 tests + build green. ruff unavailable (gap).
No commit of credentials; secrets handled via env/.env.example.
Deferred: Zep semantic A/B parity, object storage cutover, mobile QA, EasyPanel
container build of deploy topology.

docs/engineering-log/2026-08-23-local-memory-first-consumer.md

@@ -0,0 +1,28 @@
+# Local Memory First Consumer — 2026-08-23
+
+## Scope
+
+Enabled the first explicit local-memory execution path without silently changing the existing Zep default.
+
+## Changes
+
+- Added `MEMORY_BACKEND=zep|local`; unknown values fail closed.
+- Added per-request local entity-reader factory scoped by `organization_id` and `graph_id`.
+- Added worker-owned SQLAlchemy session lifecycle for local readers.
+- `SimulationManager` now accepts `entity_reader_factory` and uses it during preparation.
+- `/api/simulation/entities/*` selects the configured reader and closes it after each request.
+- `/api/simulation/prepare` uses the configured reader for preview and background preparation.
+- `OasisProfileGenerator` supports `use_zep_context=False`; local mode does not initialize Zep context for profile enrichment.
+- Default remains `MEMORY_BACKEND=zep` until remaining consumers and data migration are ready.
+
+## Evidence
+
+- Switch/route tests: 3 passed.
+- Reader factory/entity parity/injection tests: passed.
+- Full backend suite after this slice: **55 passed**.
+- Frontend suite: **10 passed**.
+- Build, compileall, and Alembic upgrade/check: passed.
+
+## Boundary
+
+This is not a full Zep removal. Profile generation still uses the legacy flow outside the explicit local preparation path, and graph tools/report consumers still need migration.