fix(gateway): CORS, memory userId from session, pgvector auto-init

- Enable CORS with credentials (GATEWAY_CORS_ORIGIN env, defaults to
  http://localhost:3000) so the web dashboard can talk to the gateway
- MemoryController: replace @Query('userId') with @CurrentUser() to
  extract userId from auth session (was passing undefined)
- MemoryController: add missing @Inject(EmbeddingService)
- docker-compose: auto-create pgvector extension via init script
- .env.example: add GATEWAY_CORS_ORIGIN

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infra/pg-init/01-extensions.sql

@@ -0,0 +1 @@
+CREATE EXTENSION IF NOT EXISTS vector;