fix(admin): scope memory provenance by tenant

[skarL007]

Summary

• applies the optional tenant filter to admin memory provenance lookups
• scopes source episodes and sibling memories to the requested tenant
• adds a regression test covering all three provenance queries

Tests

• PYTHONUTF8=1 python -m pytest tests/test_admin_memory_provenance_tenant_scope.py tests/test_admin_compiler_trace_tenant_scope.py -q
• PYTHONUTF8=1 python -m pytest tests/test_tenant_scoping_invariant.py tests/test_route_limits_invariant.py tests/test_no_raw_tokenization.py -q
• PYTHONUTF8=1 python -m ruff check server/api/admin.py tests/test_admin_memory_provenance_tenant_scope.py

[smaramwbc]

Verified: tenant scoping applied to all 3 provenance queries (memory, source episodes, siblings), matches the established admin route pattern, new unit test passes locally, ruff clean, CI green. Cross-tenant provenance leak fix for shared subjects.