refactor(routes): move memory domain into routes/memory/ subpackage (#5007)

Slice 2c of the route-domain reorganization (#4082/#4071, per
specs/architecture-runtime-inventory.md §6.3). Moves memory_routes.py into
routes/memory/, leaving a backward-compat sys.modules shim at the old path.
Pure file reorganization, no behavior change.

The shim uses sys.modules replacement (same pattern as the merged gallery
#4903 and research #4975 slices) so that `import routes.memory_routes`,
`from routes.memory_routes import X`, `importlib.import_module(...)`, and
the `import ... as mr` + `monkeypatch.setattr(mr, ...)` pattern used by
test_memory_routes_session_owner.py / test_memory_owner_isolation.py all
operate on the same module object the application uses.

The canonical module does NOT depend on the shim — routes/memory/
memory_routes.py imports only from services/, core/, src/, and stdlib (zero
internal routes/ coupling).

Four source-introspection test sites repointed to the new canonical path:
- test_direct_upload_limits.py
- test_upload_limits_centralized.py (two dict keys)
- test_vision_owner_scope.py

Adds tests/test_memory_routes_shim.py to pin the sys.modules shim contract
(legacy and canonical paths resolve to the same module object; monkeypatch
via legacy alias reaches the canonical module).

Verified: compileall clean; full suite 4219 passed, 3 skipped.

tests/test_vision_owner_scope.py

@@ -90,7 +90,7 @@ def test_request_vision_call_sites_pass_owner():
     upload_source = (ROOT / "routes" / "upload_routes.py").read_text()
     document_source = (ROOT / "routes" / "document_routes.py").read_text()
     gallery_source = (ROOT / "routes" / "gallery" / "gallery_routes.py").read_text()
-    memory_source = (ROOT / "routes" / "memory_routes.py").read_text()
+    memory_source = (ROOT / "routes" / "memory" / "memory_routes.py").read_text()
 
     assert 'analyze_image_with_vl_result(file_info["path"], owner=owner)' in chat_source
     assert "analyze_image_with_vl(path, owner=current_user)" in upload_source