Mgeeeek
f687951b1a
Adds the design document for the B+ scope fix in response to the 2026-05-01 security report on per-user API key authorization. Spec covers the require_admin helper, six admin-gated routes, the inside-route guard on GET /memories, surgical docs edits, and a minimal test scaffold for server/. owner_id work and multi-user invite flow are explicitly deferred to a tracked follow-up issue.