Build a scoped memory store with provenance-based deletion

The store has one visibility rule, written once: a record is visible if it is in the session's tenant and either in the session's matter or a client-scope record about one of that matter's clients. Everything else follows from making that rule impossible to skip. A Scope can only be built by SessionFactory.open, every read and search takes a Scope as its first argument, and firm knowledge sits in its own table behind a different session type. Deletion is a graph walk over derived_from, so a summary or evaluation copy of a person's message goes with the message. No model is called anywhere in this project, and all data is synthetic.