C-286: OAA sovereign memory layer — signed /api/oaa/kv journal

[kaizencycle]

Summary

This change introduces POST/GET /api/oaa/kv as the sovereign append journal for Mobius: HMAC-authenticated structured writes, deterministic SHA-256 hashing over canonical JSON, append-only persistence into OAA_MEMORY.json, and an async optional forward to Civic Protocol Core via POST …/mesh/ingest (when ledger URL + bearer token are configured).

Motivation / problem

The stack needs a signed, hash-chained memory trail separate from hot KV. OAA already owns OAA_MEMORY.json and governance surfaces; this PR implements the write contract and read surface described for C-286.

What changed

• types/oaa-kv.ts — AgentKVPayload and OaaMemoryEntry (OAA_MEMORY_ENTRY_V1).
• lib/crypto/canonicalJson.ts — sorted-key canonical JSON for stable signing/hashing.
• lib/crypto/hmac.ts — SHA-256 hex, HMAC sign/verify (timing-safe).
• lib/kv/store.ts — append-only journal entries merged with existing memory file shape; getLatestHash walks from the end for the latest OAA_MEMORY_ENTRY_V1 only.
• lib/ledger/bridge.ts — fire-and-forget sealToLedger using CIVIC_LEDGER_URL or LEDGER_BASE_URL + CIVIC_LEDGER_TOKEN or LEDGER_ADMIN_TOKEN.
• pages/api/oaa/kv.ts — GET ?prefix= for structured entries; POST verifies HMAC over canonical { key, value, agent, cycle, intent, previousHash }.
• render.yaml — optional KV_HMAC_SECRET and CIVIC_LEDGER_TOKEN for oaa-hub (secret also falls back to MEMORY_HMAC_SECRET / OAA_HMAC_SECRET in code).
• vitest.config.ts + tests/oaa-kv-sovereign.test.ts — unit tests for canonical JSON and HMAC.

Breaking changes

No. New endpoint and env vars; existing memory notes remain readable.

Tests

npm ci
npm run vitest
# Test Files  1 passed (1)
# Tests  3 passed (3)

npm run lint and npm run type-check still fail on pre-existing repo issues (binary/parsing TSX files, etc.); new files pass IDE diagnostics.

Checklist

• Implementation matches C-286 OAA PR scope (this repo only)
• Vitest added and passing
• Full repo lint/type-check clean (blocked by unrelated files)