[yusiwen]

What changed

• agent/memory.go: the hard-coded https://memory.yusiwen.cn/dp-api default and the hard-coded
  hermes bank are gone. NewHTTPMemoryClient(baseURL, bank) now returns an error for an empty base
  URL, so a client cannot exist without an endpoint; the bank comes from the caller and falls back to
  default.
• main.go: memoryStore passes memory.bank and lets the constructor fail; the composition root
  already logs a store it cannot build and runs without memory.
• agent/memory_test.go: the two "default base" assertions are replaced by
  TestHTTPMemoryClientRequiresAnEndpoint (empty and blank rejected, the error names base_url, the
  bank defaults, a named bank survives), and the stub server's paths use a test bank.
• memory_wiring_test.go: the hindsight case asserts the configured base and the bank, and a new test
  pins that a hindsight spec with no base_url is an error.
• Docs: CODEBASE.md (endpoint required, bank from config), config.example.json ("'hindsight'
  requires base_url"), docs/memory-decision.md (the endpoint rule is enforced, not just stated), and
  docs/roadmap.md's B2 evidence keeps its baseline wording with a note that the default is gone.
• Test count 1228 → 1230 in the two places that state it.

Why

{"memory": {"backend": "hindsight"}} — the backend named, no endpoint — built a client whose base URL
fell back to a hard-coded service. Every run would have sent its prompt to a deployment the user never
named, while the decision record promised that the endpoint is theirs to write. The code enforced the
"own config file" half of that sentence and not the "endpoint" half.

The bank had the same defect in miniature: memory.bank existed in the config, was parsed, was read by
nobody, and the client used one deployment's bank name. It now comes from the config.

Verification

• go test ./... -count=1 → 16 packages ok; go vet and gofmt -l clean.
• Mutation check: the empty-base refusal disabled → TestHTTPMemoryClientRequiresAnEndpoint fails with
  an empty base URL was accepted; restored, it passes.
• grep -rn 'memory.yusiwen.cn' --include=*.go . → no hits; the only remaining mention is the roadmap's
  pinned B2 evidence line, which now says the default no longer exists.
• git log --format='%h %G? %s' → G.

Honest scope

• The OPENAI_API_KEY fallback in auth() is untouched: it is a separate item (S4 of [memory] Local store, wired recall, and one explicit writer #293) about which
  credential is sent, not where.
• The adapter's recall/list decoders still read the old response fields (S4). This PR only removes the
  default endpoint and makes the config authoritative.
• Existing configs that used backend: hindsight without a base_url were pointing at the author's
  service; they now fail at startup with a message that names the missing key. That is the intended
  change, and it is stated in the report.

Follow-ups

• [memory] Local store, wired recall, and one explicit writer #293 S4: probe a real Hindsight deployment, align the decoders, drop the OpenAI-key fallback, and give
  the backend ctx on the calls that lack it.
• [test] TestCancelledRunMakesNoFurtherRequest fails under the repeated run #295 remains open.

Refs #293