feat: per-user auto-memory with ResponseContext

Three memory channels: hidden tool (sol.memory.set/get in scripts),
pre-response injection (relevant memories loaded into system prompt),
and post-response extraction (ministral-3b extracts facts after each
response). User isolation enforced at Rust level — user_id derived
from Matrix sender, never from script arguments.

New modules: context (ResponseContext), memory (schema, store, extractor).
ResponseContext threaded through responder → tools → script runtime.
OpenSearch index sol_user_memory created on startup alongside archive.

Dockerfile

@@ -1,13 +1,28 @@
-FROM rust:1.86 AS builder
+FROM rust:latest AS deps
 WORKDIR /build
 
-# Configure Sunbeam Cargo registry (Gitea) — anonymous read access
-RUN mkdir -p /usr/local/cargo/registry && \
-    printf '[registries.sunbeam]\nindex = "sparse+https://src.sunbeam.pt/api/packages/studio/cargo/"\n' \
-    >> /usr/local/cargo/config.toml
+# Copy dependency manifests and vendored crates first (cached layer)
+COPY Cargo.toml Cargo.lock ./
+COPY vendor/ vendor/
 
-COPY . .
-RUN cargo build --release --target x86_64-unknown-linux-gnu
+# Set up vendored dependency resolution
+RUN mkdir -p .cargo && \
+    printf '[registries.sunbeam]\nindex = "sparse+https://src.sunbeam.pt/api/packages/studio/cargo/"\n\n[source.crates-io]\nreplace-with = "vendored-sources"\n\n[source."sparse+https://src.sunbeam.pt/api/packages/studio/cargo/"]\nregistry = "sparse+https://src.sunbeam.pt/api/packages/studio/cargo/"\nreplace-with = "vendored-sources"\n\n[source.vendored-sources]\ndirectory = "vendor/"\n' \
+    > .cargo/config.toml
+
+# Build deps only with a dummy main.rs — this layer is cached until Cargo.toml/vendor change
+RUN mkdir -p src && echo "fn main(){}" > src/main.rs && \
+    cargo build --release --target x86_64-unknown-linux-gnu && \
+    rm src/main.rs && rm target/x86_64-unknown-linux-gnu/release/sol
+
+FROM deps AS builder
+
+# Copy actual source — only Sol code recompiles, deps are cached
+COPY src/ src/
+
+# Touch source to ensure cargo detects changes (COPY preserves host mtimes)
+RUN find src/ -name '*.rs' -exec touch {} + && \
+    cargo build --release --target x86_64-unknown-linux-gnu
 
 FROM gcr.io/distroless/cc-debian12:nonroot
 COPY --from=builder /build/target/x86_64-unknown-linux-gnu/release/sol /