云端身份与记忆：用户画像+分级记忆，不动 thread

- 新增 cloud/identity.py：user_profiles（显示名/时区/偏好，偏好禁密钥键）
  与 identity_memories（user 级仅本人可见、project 级项目成员可见，
  kind fact/preference/decision/convention，supersede 链+物理删除）。
- server 新增 /users/me/profile、/users/me/memories、/projects/{id}/
  identity-memories、/users/me/identity-context，项目记忆先过项目
  read/create_task 门；上下文只显式取用，不自动注入任务/thread。
- PG schema 与迁移清单同步新增两张 TEXT 主键表，序列清单不动；
  server 补 do_PUT 入口（/users/me/profile 首个 PUT 路由）。
- 新测试 11 个；三套件 cloud 937 OK（4 跳过）、host 89 OK、deploy 29 OK。
- 未动：host.py、worker、CODEX_HOME、旧 summaries 表、控制台 UI；
  未推、未建 PR、未部署。

cloud/db.py

@@ -945,6 +945,27 @@ POSTGRES_SCHEMA = (
     "preference TEXT NOT NULL, "
     "created_at DOUBLE PRECISION, "
     "UNIQUE(project_id, user_id, channel, target))",
+    # System-level identity (cloud/identity.py): TEXT primary keys,
+    # so no IDENTITY sequence to keep in sync in migrations.py.
+    # DDL must match cloud/identity.py CREATE TABLE statements.
+    "CREATE TABLE IF NOT EXISTS user_profiles("
+    "user_id TEXT PRIMARY KEY, "
+    "display_name TEXT, "
+    "timezone TEXT, "
+    "preferences TEXT, "
+    "updated_at DOUBLE PRECISION)",
+    "CREATE TABLE IF NOT EXISTS identity_memories("
+    "id TEXT PRIMARY KEY, "
+    "owner_user_id TEXT, "
+    "scope TEXT, "
+    "project_id TEXT, "
+    "kind TEXT, "
+    "content TEXT, "
+    "source_thread_id TEXT, "
+    "status TEXT DEFAULT 'active', "
+    "superseded_by TEXT, "
+    "created_at DOUBLE PRECISION, "
+    "updated_at DOUBLE PRECISION)",
 )