- #8: Extract shared resolveLocaleKey utility to src/utils/resolveLocaleKey.ts,
  remove 4 duplicated implementations
- #9: Add mountedRef guard in AutoResearchHub.handleConfigure to prevent
  React state-update-on-unmounted warning
- #11: Extract IIFE in GuidedPromptStarter into GuidedAutoResearchMenu
  sub-component for proper React memoization

…r fixes

Fixes for PR OpenLAIR#146 review by @Zhang-Henry:

Critical:
- OpenLAIR#1: memory_enabled is now per-user (column on users table) instead of
  global app_settings. Each user controls their own memory toggle.
- OpenLAIR#2: ~/.claude/MEMORY.md namespaced as MEMORY-{userId}.md to prevent
  multi-user overwrites on shared servers.

High:
- OpenLAIR#3: req.params.id validated as positive integer with parseInt + isNaN guard
- OpenLAIR#4: Memory content sanitized (strip markdown headings) before prompt injection;
  content length capped at 500 chars; max 50 memories per user
- OpenLAIR#5: Content length validation (400 error) on create and update routes
- OpenLAIR#6: Delete now requires window.confirm() before executing

Medium:
- OpenLAIR#8: Removed no-op try/catch wrappers from all memoryDb methods
- OpenLAIR#9: Added comment explaining why Gemini injects memory into user prompt
  (CLI has no system instruction API)
- OpenLAIR#10: Changed index from (is_enabled) to composite (user_id, is_enabled)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>