Add read-only historical memory provenance audit

[NovasPlace]

Summary

Adds a read-only provenance audit before any historical backfill work.

The report measures:

• total and active memory counts
• complete effective provenance across all history
• complete effective provenance for active memories
• rows with any provenance gap
• missing counts for each required provenance field
• source_session_id using the same top-level session_id fallback used by bridge provenance
• explicit unknown model IDs
• existing default model-ID placeholders, including active counts

The existing scripts/csm-audit.ts now prints the report.

Safety

• no schema changes
• no historical row updates
• no backfill
• no retrieval/governance behavior changes
• PostgreSQL and SQLite query generation are both covered by tests

This gives us the blast-radius data needed before deciding how to repair legacy provenance or the current source_model_id = "default" fallback.