docs(memory): document reserved 'user' sourceType and guard against agent writes

The 'user' variant of MemorySourceType is intentionally reserved for future
dashboard manual entry (user-authored rows), which was designed but never
implemented. Agent-originated memories (historian/dreamer/tool) must never
carry sourceType 'user' — origin provenance matters to the agent, historian
dedup, and dreamer curation.

Add a doc comment on the variant capturing that intent, and a one-line guard
in insertMemory (the single write choke point all agent write paths flow
through) that rejects sourceType 'user', with a test proving the guard fires.

Co-Authored-By: Alfonso <alfonso@cortexkit.io>