Re-fit the Archive Map's basis (moves every point)

DESTRUCTIVE TO POSITIONS, deliberately explicit. Re-fits the PCA basis at the current corpus_version and answers with the map it just fitted. Every point in the namespace moves, for every member of the workspace — warn the user before calling it.

A separate route rather than ?refit=true on the GET so that a fumbled query string on a read can never reshuffle a map, and so a read-only client cannot express the operation at all.

Requires memories:write, which is STRICTER than the memories:read Kairos itself asks for: the basis is shared process state keyed by (workspace, namespace), so re-fitting mutates what every other member sees. ReadOnly members, and credentials consented to memories:read only, may draw the map but not move it.

Body {ns} — absent re-fits EVERY namespace in the workspace. On success the gateway drops its cached maps for that namespace across all credential ceilings, so no client keeps serving the old positions.

Requires the memories:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:write — every key minted before scoping keeps working here.