Thoughts, step 1: POST /api/v1/thoughts keeps a forge-level thought verbatim in an append-only table #1658

Split from #1060 (the owner's ask: every thought kept exactly as typed, forever). Server side only; no page, no MCP.

Done looks like:

• [ ] A thought table in src/core/schema.ts: id, author, verbatim text, source (composer, api, mcp, share), received_at. No UPDATE or DELETE of it anywhere in src/; the table is in backups like every other.
• [ ] POST /api/v1/thoughts {text} with a rw token stores it with source api and answers {id}; empty or duplicate text is still stored; text is capped at a stated length and anything longer is a 422 with a plain sentence; a cross-origin cookie POST is refused.
• [ ] Each stored thought emits thought.received on the outbox (src/core/events.ts).
• [ ] test/thoughts.test.ts, named in GATE in scripts/gate.ts in the same commit: verbatim round-trip (whitespace, unicode, newlines), duplicate kept, no update/delete path (grep test), the event is emitted.
• [ ] Start from today's main; before pushing run bun x tsc --noEmit, bun test test/thoughts.test.ts test/check-list.test.ts. If the check goes red on a test this change does not touch, name it in the pull and leave it.

Files: src/core/schema.ts, src/core/events.ts, a new src/actions/thought.ts, src/http (api route), scripts/gate.ts, one test.