Harden Hoard runtime, security, and scale paths

[thrr87]

Summary

• fix correctness/security hot spots (memory_put/upsert, artifact traversal hardening, constant-time token compares, heartbeat write classification, bm25 normalization)
• improve reliability and runtime safety (writer startup fail-fast, flock-based sync lock, SSE connection lifecycle, WAL checkpoint policy)
• decouple audit/rate-limit hot path and add observability (async audit sink, in-memory limiter, structured logging, /metrics)
• improve scale behavior (bounded vector candidates, duplicate worker candidate bounds, N+1 tag fetch removal, ANN scaffolding + migrations)
• add config/schema/maintainability work (typed config validation, shared error/scope/time utilities, canonical tool aliases + legacy compatibility)
• add operational UX improvements (stdio write opt-in, db backup/restore commands with checksum verification)

Testing

• .venv/bin/python -m pytest
• result: 152 passed