feat: atomic supersede via replaces on memory create

[doctatortot]

Closes #8.

Implements the design from #8 per your review there — replaces: string[] on POST /v1/memories for atomic consolidate-into-one. New memory is created, each listed old gets state=superseded, superseded_by=<new.id>, invalidated_at=now(). Default search/list now filters state NOT IN ('deleted', 'superseded'); opt-in via include_superseded=true.

Maintainer points addressed

Point from #8 review	This PR
A1 (replaces on POST), not A2	✅
Reuse invalidated_at, no new timestamp	✅ supersede_batch sets it
New Superseded state variant	✅ MemoryState::Superseded + FromStr/Display + filter integration
Default search/list excludes superseded	✅ state NOT IN ('deleted', 'superseded') everywhere; include_superseded=true on /search and /memories opts back in
memory_get returns superseded regardless	✅ get_by_id already unfiltered, unchanged
400 with list of missing IDs	✅ supersede_batch precheck collects missing + already-superseded IDs and returns Validation with both lists; handler maps to 400
No cross-tenant 403 (physical isolation)	✅ unknown ID → missing
Tag inheritance: none	✅ caller controls tags on new memory
Plugin: replaces on memory_store	✅

One open question: you suggested 409 on already-superseded; I implemented it as 400 Validation with explicit already superseded: [...] in the error body, so it shares the precheck shape with missing-IDs. Happy to switch to a distinct 409 if you'd rather. Let me know in review.

Atomicity caveat

LanceDB has no multi-row transactions, so supersede_batch follows the same shape as your existing handle_supersede in reconciler.rs:231:

1. Precheck every old_id exists + isn't already superseded. On any failure, return Err before any write happens.
2. Create the new memory.
3. Mark each old as superseded (sequential update calls).

If step 3 partially fails after step 2 succeeded, the new memory exists but the chain is partial. The error names the failing IDs so the caller can retry the marks. Worth documenting; alternative would be a soft-rollback that deletes the new on partial failure — I leaned toward the same shape as the existing internal precedent.

Tests

Store layer (4 new):

• test_supersede_batch_marks_old_as_superseded
• test_supersede_batch_rejects_missing_id (precheck → no writes)
• test_supersede_batch_rejects_already_superseded
• test_default_state_filter_excludes_superseded (+ include_superseded=true resurfaces, + get_by_id still returns)

API layer (3 new):

• test_create_with_replaces_supersedes_old
• test_create_with_missing_replaces_returns_400 (asserts the real ID's state is still active — no half-state)
• test_search_excludes_superseded_by_default (+ include_superseded=true opt-in)

Test totals

386 passed; 0 failed. Was 379 before this PR. +7 new, zero regressions.

🤖 Generated with Claude Code

[yhyyz]

Merged and deployed! Thanks @doctatortot — excellent implementation that follows the design we agreed on in #8 to the letter. 386→388 tests, all green. 🚀

The replaces precheck (400 with missing/already-superseded lists) is a good design choice — using 400 Validation instead of 409 is fine, keeps it consistent with the existing error shape.