multi-tenant Phase 1: user registry + per-user memory

- CDK: add agent-claw-users DynamoDB table (actor_id PK, RETAIN policy)
- CDK: grant agent-runner read/write on users table; add USERS_TABLE_NAME env
- CDK: fix cdk.json app field (was object, must be command string)
- CDK: add UsersTableName output
- agent-runner: get_or_create_user() auto-registers users on first contact
  (stores display_name, telegram_username, created_at, allowed)
- agent-runner: pass user_profile in AgentCore payload
- prompt_builder: split base prompt (cached) from per-user context (injected per-call)
  removes USER.md/MEMORY.md from shared load; user name/username injected dynamically
- main.py: extract user_profile from payload, build user_context string for prompt

cdk/lib/agent-claw-stack.ts

@@ -65,6 +65,14 @@ export class AgentClawStack extends cdk.Stack {
       removalPolicy: cdk.RemovalPolicy.RETAIN,
     });
 
+    // ── DynamoDB user registry ─────────────────────────────────────────────
+    const usersTable = new dynamodb.Table(this, 'UsersTable', {
+      tableName: 'agent-claw-users',
+      partitionKey: { name: 'actor_id', type: dynamodb.AttributeType.STRING },
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      removalPolicy: cdk.RemovalPolicy.RETAIN,
+    });
+
     // ── SQS FIFO message queue ─────────────────────────────────────────────
     const messageQueue = new sqs.Queue(this, 'MessageQueue', {
       queueName: 'agent-claw-messages.fifo',
@@ -110,6 +118,8 @@ export class AgentClawStack extends cdk.Stack {
     });
 
     sessionTable.grantReadWriteData(agentRunnerFn);
+    usersTable.grantReadWriteData(agentRunnerFn);
+    agentRunnerFn.addEnvironment('USERS_TABLE_NAME', usersTable.tableName);
     workspaceBucket.grantRead(agentRunnerFn);
     botTokenSecret.grantRead(agentRunnerFn);
     braveApiKeySecret.grantRead(agentRunnerFn);
@@ -245,6 +255,11 @@ export class AgentClawStack extends cdk.Stack {
       description: 'DynamoDB table for session mapping',
     });
 
+    new cdk.CfnOutput(this, 'UsersTableName', {
+      value: usersTable.tableName,
+      description: 'DynamoDB user registry table',
+    });
+
     new cdk.CfnOutput(this, 'MessageQueueUrl', {
       value: messageQueue.queueUrl,
       description: 'SQS FIFO queue for incoming messages',