feat(memory): add TOS ContextBucket long-term memory backend

[huangmorven]

Introduce a tos_context long-term memory backend backed by Volcengine TOS ContextBucket, and wire it through configuration, the cloud harness, tests, and docs.

Backend & wiring

• Add TosContextBucketLTMBackend that maps VeADK's memory abstraction onto ContextBucket coordinates (app_name/index -> context bucket, user_id -> context set), with lazy bucket ensure and the standard save/search hooks.
• Register the backend under backend="tos_context" and strip the injected session_id / app_name kwargs the SDK does not accept.
• Add TOSContextBucketConfig and the harness env mapping so the backend can be configured from config.yaml and provisioned on the cloud platform.

Credentials

• Resolve credentials via _get_ak_sk_sts(): use explicit AK/SK (with the STS token from VOLCENGINE_SESSION_TOKEN) when both are present, otherwise fall back to the VeFaaS IAM credential file, mirroring VikingDBLTMBackend so keyless cloud (VeFaaS / AgentKit) deployments authenticate correctly.
• Use the global VOLCENGINE_SESSION_TOKEN for the STS token instead of a standalone DATABASE_TOS_CONTEXT_SECURITY_TOKEN, matching TOS object storage and other components.

Fail-closed dependency handling

• ContextBucket APIs require tos>=2.9.4b1 (beta). Keep the core dependency at tos>=2.8.4 and probe TosClientV2 for the required methods at init, raising a clear RuntimeError with the upgrade command when the installed SDK is too old.

Tests & docs

• Add backend and harness tests covering the explicit / IAM-fallback / VOLCENGINE_SESSION_TOKEN-default credential paths and the env mapping.
• Add zh/en wiki pages, update the long-term memory index and sidebar, and extend config.yaml.full with the tos_context section and credential notes.