Build and attack a per-matter memory-tool handler

Scoping lives in two places, and both are outside the model's reach. A Session(firm_id, matter_id, agent) is built by your code from whatever authenticated the request. MemoryStore.handle(session, tool_input) only ever reads command fields from the tool input, so a model that writes "matter_id": "M-2" into a call changes nothing. Every path then goes through one resolve function that rejects anything that can't be proven to land inside that session's directory. The decision that matters most is that the resolved real path is the final check: string checks catch the obvious attacks cheaply, but only Path.resolve() followed by is_relative_to catches a symlink.