feat(cli): add locked and multi-space MCP modes

[jgpruitt]

Goal

Allow a single Memory Engine MCP server to work across accessible spaces without relying on a project or stored active-space default.

Changes

• Add two explicit MCP modes:
• Locked: --space or ME_SPACE fixes all memory operations to one space.
• Multi-space: no explicit selector; memory tools require a per-call space and expose me_space_list.
• Keep per-call space selection same-server only; authorization, membership, grants, and restricted-key limits remain server-enforced.
• Build isolated memory clients per call to prevent X-Me-Space header leakage during concurrent tool calls.
• Make unpinned session and API-key agent installations consistently multi-space.
• Document the conditional tool surface across MCP, CLI, and agent-install guides.
• Harden startup/input handling for blank, whitespace-padded, and templated space values.