Project memory: let a tenant purge a unit

Found while working Task 6688 (item 5, declined there as out of scope: it changes Task 6670's Project memory gate). While an org's `project_memory_enabled` plan switch is off, every Project memory route — including `DELETE /api/projects/{project_id}/memory/units/{unit_id}` (purge) — answers 403 (`apps/api/app/routes/project_memory.py::require_memory_plan`), and Project › Memory is hidden for tenants (`apps/web/src/pages/ProjectEditPage.tsx::tabsFor`). A tenant that must erase a unit (an erasure / PII request) cannot: an operator has to flip the override on, purge, and flip it off. Ask: keep Purge reachable (API + a minimal UI entry) for `projects:edit` holders while the plan switch is off, so stored memory can always be erased. Reads, retire and everything else stay gated. Out of scope: any other Project memory behaviour; the plan switch's defaults; reads of memory while off. Done means: - An API test: with the plan off, a `projects:edit` caller's purge answers 200 and removes the unit; every other memory route still 403s. - A web test: a tenant on an off plan can reach Purge for an existing unit. - Security review of the diff (PII/erasure surface). - `./dc check full` green.

Off the plan, a projects:edit holder can now purge a memory unit by id or mem-N, via the API and an erase-only Memory tab. Every other memory route still 403s. Full gate green, both review lanes pass, visual check OK. PR #5645 merged. Follow-ups filed as draft #6733.