feat: graph UI: edit tags and metadata in detail panel

[justinTM]

Title

Add editable tags and metadata to the graph detail panel

Summary

This PR adds per-entry tag and metadata editing to the live graph UI. The detail panel now shows read-only scalar metadata, separates complex metadata into its own block, and supports inline editing of tags and scalar key/value metadata with save/cancel controls.

The change also unifies the update flow behind PATCH /api/memories/{id} for both the local graph server and the Cloudflare Pages endpoint, so the UI can persist tags, metadata, and favorite state through one consistent API.

What changed

• Graph detail panel:

  • added Edit, Save, and Cancel controls
  • added editable tag rows with add/remove/rename support
  • added editable scalar metadata rows with add/remove/edit support
  • kept complex metadata read-only and displayed separately
  • kept content read-only
  • added inline validation and status messaging

• Graph update API:

  • local server now supports PATCH /api/memories/{id}
  • Cloudflare Pages memory endpoint now supports the same PATCH contract
  • PATCH returns the full updated memory payload so the UI can refresh from server state
  • favorite toggling now uses the same update path

• Validation/testing:

  • added local graph server PATCH tests for:
    • tags + metadata updates
    • favorite compatibility
    • missing memory 404
    • tag whitelist rejection

Implementation notes

• Editable metadata is limited to scalar values in this PR:

  • string
  • number
  • boolean
  • null

• Complex metadata such as arrays/objects remains visible but read-only.

• images is treated as reserved/system-managed and is excluded from inline editing.

• Tag edits still respect the existing backend whitelist.

Browser validation

I also exercised the feature end-to-end in the live graph UI with Playwright on an isolated worktree-specific graph URL. That surfaced and fixed two frontend issues:

• entering edit mode could fail after SSE refreshes cleared memoryCache
• save could persist stale draft state instead of the current DOM input state

Testing

• python3 -m py_compile memora/graph/server.py tests/test_graph_server.py
• python3 -m pytest tests/test_graph_server.py -q

Notes / follow-up

• Static export remains read-only and unchanged.
• Global tag management (rename/color management across all entries) is still out of scope.
• The current tag whitelist can constrain which edited tags are valid in a given environment.

[spokV]

LGTM — solid feature addition. Inline tag/metadata editing works well through the UI. A few follow-up items worth addressing (opening as issues):

1. escapeHtmlText() doesn't escape quotes — attribute injection possible in tag/metadata editor inputs
2. PATCH endpoints replace metadata entirely instead of merging with existing keys
3. Cloudflare PATCH bypasses tag whitelist validation (local server is protected)
4. rerenderPanelDraft() writes draft into memoryCache, so Cancel shows stale draft
5. run-memora-graph.sh hardcodes .venv/bin/memora-server and source ~/.bashrc

None are blockers — the UI sends full objects so data loss doesn't occur in practice, and the graph UI isn't public-facing.