Workspace memory isolation: enforce workspace and project scoping server-side #1678

Memory reads and listings rely on client-side filtering, and the engine memory search returned memories from other workspaces.

Items

• security: memory list API has no server-side workspace scoping (client-side filter only) #1140: Memory list API has no server-side workspace scoping; memory-sync.ts accepts global blocks unconditionally.
• workspace: datamate_search_memory returns memories from other workspaces and projects; the engine memory hub is not scoped to the bound workspace #1351: datamate_search_memory returned other workspaces' memories. Engine and lambda fixes are merged; the isolation reproduction still needs to be repeated after deployment.

The linked issues hold the original reports and reproductions. Most are closed in favor of this tracker; any child with an open fix PR stays open until that PR lands.