feat(users): UserManager with per-user SQLCipher, and extract skald-core crate

Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.

crates/skald-core/src/memory/mod.rs

@@ -0,0 +1,101 @@
+//! Memory abstraction layer.
+//!
+//! Provides a [`Memory`] trait for pluggable long-term memory backends, and a
+//! [`MemoryManager`] that holds at most **one** active backend at a time.
+//!
+//! # Singleton rule
+//! Only one backend can be registered. If a second backend (with a different id)
+//! tries to register, it is rejected with an `error!` log and the first one is
+//! kept. The same backend can re-register itself (e.g. after a config change /
+//! restart) — that replaces the existing registration cleanly.
+//!
+//! # Integration points
+//! - [`Memory::query_context`] is called at the start of every `handle_message`
+//!   turn. The returned string is prepended to `extra_system_context` and
+//!   injected into the system prompt.
+//! - [`Memory::tools`] is called per turn; the returned tools are added to the
+//!   LLM's tool list and dispatched before the global registry.
+
+use std::sync::Arc;
+
+use serde_json::Value;
+use tokio::sync::RwLock;
+use tracing::{error, info};
+
+pub use core_api::memory::Memory;
+
+use crate::tools::Tool;
+
+// ── MemoryManager ─────────────────────────────────────────────────────────────
+
+pub struct MemoryManager {
+    backend: RwLock<Option<Arc<dyn Memory>>>,
+}
+
+impl MemoryManager {
+    pub fn new() -> Self {
+        Self { backend: RwLock::new(None) }
+    }
+
+    /// Registers a memory backend.
+    ///
+    /// - If no backend is registered yet, the new one is accepted.
+    /// - If the same backend id re-registers (restart / config change), it replaces
+    ///   the old entry.
+    /// - If a **different** backend id tries to register while one is already active,
+    ///   it is rejected with `error!` and the existing backend is kept.
+    pub async fn register(&self, backend: Arc<dyn Memory>) {
+        let mut lock = self.backend.write().await;
+        match lock.as_ref() {
+            None => {
+                info!("MemoryManager: registered backend '{}'", backend.id());
+                *lock = Some(backend);
+            }
+            Some(existing) if existing.id() == backend.id() => {
+                info!("MemoryManager: replacing backend '{}' (restart/reload)", backend.id());
+                *lock = Some(backend);
+            }
+            Some(existing) => {
+                error!(
+                    "MemoryManager: backend '{}' is already registered — \
+                     discarding '{}'. Only one memory backend is supported at a time.",
+                    existing.id(),
+                    backend.id(),
+                );
+            }
+        }
+    }
+
+    /// Returns memory context to inject into the system prompt for the upcoming
+    /// turn. Returns `None` if no backend is registered or the backend is
+    /// unavailable / has nothing to say.
+    pub async fn query_context(&self, session_id: i64, user_message: &str) -> Option<String> {
+        let backend = self.backend.read().await.clone()?;
+        if !backend.is_available() {
+            return None;
+        }
+        backend.query_context(session_id, user_message).await
+    }
+
+    /// Returns the per-turn LLM tools exposed by the active backend.
+    /// Empty if no backend is registered or the backend is unavailable.
+    pub async fn tools(&self) -> Vec<Arc<dyn Tool>> {
+        let backend = self.backend.read().await.clone();
+        match backend {
+            Some(b) if b.is_available() => b.tools(),
+            _ => vec![],
+        }
+    }
+
+    /// Builds OpenAI-format tool definitions from the active backend's tools.
+    pub async fn tool_defs(&self) -> Vec<Value> {
+        self.tools().await
+            .iter()
+            .map(|t| t.openai_definition())
+            .collect()
+    }
+}
+
+impl Default for MemoryManager {
+    fn default() -> Self { Self::new() }
+}