feat(auth): connect Memoria identity and scoped memory

.env.example

@@ -146,6 +146,12 @@ ASTRA_RUNTIME_ROOT_SECRET=your-runtime-root-secret-min-32-characters-change-me
 #
 # MEMORIA_BASE_URL: HTTP endpoint of the Memoria API.
 MEMORIA_BASE_URL=http://127.0.0.1:8100
+# Stable identity authority (defaults to the normalized API URL).
+# MEMORIA_ISSUER=https://memoria.example.com
+# Server-owned login website; leave unset for self-hosted password login.
+# MEMORIA_WEB_URL=https://thememoria.ai
+# Only set after confirming which issuer owns pre-issuer identity mappings.
+# MEMORIA_LEGACY_ISSUER=http://127.0.0.1:8100
 
 # MEMORIA_MASTER_KEY: API authentication key.
 #   Requirements: minimum 16 characters.
@@ -175,6 +181,25 @@ MEMORIA_EMBEDDING_API_KEY=
 #     http://localhost:11434/v1              — Ollama (local)
 MEMORIA_EMBEDDING_BASE_URL=
 
+# ── Personal BYOK endpoint policy ────────────────────────────────────────
+# Personal OpenAI-compatible BYOK endpoints: public HTTPS by default.
+# Opt into the existing administrator host/port registry with trusted-domains.
+# Both modes reject private/metadata targets, pin public DNS, and disable redirects.
+# ASTRA_BYOK_ENDPOINT_POLICY=public-https
+# Cloud BYOK rejects deployment-owned model inference for all end users.
+# Memoria identities are always personal BYOK, even in self-hosted mode.
+# ASTRA_DEPLOYMENT_MODE=self-hosted
+# Custom BYOK DNS queries go directly to system-configured DNS servers, avoiding
+# OS Fake-IP caches. DNS priority is preserved rather than racing nameservers.
+# Optionally choose reachable DNS IPs (comma-separated, ports optional).
+# ASTRA_BYOK_DNS_SERVERS=10.0.0.53,10.0.0.54:53
+# If UDP DNS is intercepted, explicitly select TCP-only DNS (no UDP fallback).
+# ASTRA_BYOK_DNS_SERVERS=tcp://10.0.0.53:53
+# Default is direct egress. Optional operator-owned HTTP(S) CONNECT or SOCKS5 proxy.
+# Ambient HTTP_PROXY/HTTPS_PROXY/ALL_PROXY are not used for custom BYOK endpoints.
+# The proxy must accept validated public IP targets; origin TLS/SNI remains unchanged.
+# ASTRA_BYOK_PROXY_URL=http://127.0.0.1:7890
+
 # ── Skill Selector Rerank (optional) ──────────────────────────────────────
 # Optional LLM-based reranker for skill selection. Uses any OpenAI-compatible
 # chat completions endpoint. Leave all unset to disable (keyword matching only).