Let the server decide whose memory a caller may read

A holder is now somebody who can prove it. Schema v11 stores a sha256 of a
per-holder token beside the directory row, so a copied database cannot replay
it and the plaintext is shown exactly once. The operator token mints and
revokes those tokens; a holder token reads that holder's own memories and
nothing else; naming somebody else without the operator token is refused with
both ids in the message.

The visibility rule was leaking before this: browse had none at all, and the
search rules short-circuited to the whole library whenever no holder was
named. The rule is now written out in five copies with one parameter carried
four times, and a test compares the copies so they cannot drift — semgrep
rejects an interpolated constant, so the copies are not a choice.

Eyes carry three states on purpose. NULL means the whole library, which is
what a process that owns the store is entitled to; a holder id means that
holder; the empty string means nobody, which is what a tokenless HTTP caller
is. Making NULL mean nobody instead would have forced every internal caller —
CLI, proofs, the compiler, the bench harnesses — to name eyes, contradicting
the rule that a local process reads as its own trusted principal.

The capability card answers "can this store answer my kind of question" before
anything is sent. It is derived from what the store holds, so it cannot
promise a modality the store lacks, and it carries no memory text, so it is
safe to read before trusting the store. HTTP, CLI and one MCP tool all serve
it without a token.

backend/src/ely_eye/migrations.py

@@ -16,7 +16,7 @@ import sqlite3
 from .storage import token_equivalent, visual_token_equivalent
 from .text_index import index_text
 
-SCHEMA_VERSION = 10
+SCHEMA_VERSION = 11
 
 ATOM_COLUMNS_V2 = """
     atom_id TEXT PRIMARY KEY,
@@ -96,6 +96,8 @@ _BASE_TABLES = """
             CHECK (kind IN ('person', 'agent', 'service')),
         knows_about_json TEXT NOT NULL DEFAULT '[]',
         contact_json TEXT NOT NULL DEFAULT '{}',
+        token_hash TEXT,
+        token_issued_at TEXT,
         created_at TEXT NOT NULL,
         updated_at TEXT NOT NULL
     );
@@ -290,6 +292,13 @@ def _recount_visual_tokens(connection: sqlite3.Connection) -> None:
     connection.executemany("UPDATE atoms SET token_equivalent = ? WHERE atom_id = ?", updates)
 
 
+_NEW_HOLDER_COLUMNS: tuple[tuple[str, str], ...] = (
+    ("token_hash", "TEXT"),
+    ("token_issued_at", "TEXT"),
+)
+"""A holder proves its identity with a bearer token; only its hash is kept, so a copied database cannot replay it."""
+
+
 def apply(connection: sqlite3.Connection) -> None:
     """Bring the schema to SCHEMA_VERSION, in place, without losing rows."""
     version = int(connection.execute("PRAGMA user_version").fetchone()[0])
@@ -314,6 +323,11 @@ def apply(connection: sqlite3.Connection) -> None:
             for name, definition in columns:
                 if name not in existing:
                     connection.execute(f"ALTER TABLE atoms ADD COLUMN {name} {definition}")
+    if version < 11:
+        existing_holders = _column_names(connection, "holders")
+        for name, definition in _NEW_HOLDER_COLUMNS:
+            if name not in existing_holders:
+                connection.execute(f"ALTER TABLE holders ADD COLUMN {name} {definition}")
     if version < 10:
         # CREATE VIEW IF NOT EXISTS keeps the old body, and v10 changed which rows are current, so an upgraded store must be told to look again.
         connection.execute("DROP VIEW IF EXISTS v_atoms_current")