Memory 4: REST API

Add an authenticated /v1/memory router using the existing src/server/app/api/v1/router.py pattern.

Proposed surface:

• POST /v1/memory/threads
• GET /v1/memory/threads/{thread_id}/messages
• POST /v1/memory/threads/{thread_id}/messages
• DELETE /v1/memory/threads/{thread_id}
• POST /v1/memory/search
• POST /v1/memory/memories
• PATCH /v1/memory/memories/{memory_id}
• DELETE /v1/memory/memories/{memory_id}
• GET /v1/memory/threads/{thread_id}/context-card

Use POST for search because metadata filters can be structured and should not be placed in query strings or access logs.

Important deletion semantics:

• "New conversation" should rotate to a new thread.
• delete_thread is a separate destructive operation because the SDK cascades through messages, derived memories, and retrieval data.
• Deleting an individual message does not necessarily remove memories previously derived from it.

Reference: Oracle Agent Memory thread API.

Start by reading src/server/app/api/v1/router.py to follow the existing router pattern, then compare the proposed routes with the Oracle Agent Memory thread API reference. Done means the authenticated /v1/memory surface exists with the listed thread, message, search, memory, and context-card operations, including the stated deletion semantics.