fix(gateway): CORS, memory userId from session, pgvector auto-init

- Enable CORS with credentials (GATEWAY_CORS_ORIGIN env, defaults to
  http://localhost:3000) so the web dashboard can talk to the gateway
- MemoryController: replace @Query('userId') with @CurrentUser() to
  extract userId from auth session (was passing undefined)
- MemoryController: add missing @Inject(EmbeddingService)
- docker-compose: auto-create pgvector extension via init script
- .env.example: add GATEWAY_CORS_ORIGIN

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -9,6 +9,7 @@ services:
       POSTGRES_DB: mosaic
     volumes:
       - pg_data:/var/lib/postgresql/data
+      - ./infra/pg-init:/docker-entrypoint-initdb.d:ro
     healthcheck:
       test: ['CMD-SHELL', 'pg_isready -U mosaic']
       interval: 5s