Summary

Implements PR (a) of #225. Adds a two-tier exclude system for indexing:

• Built-in denylist — _BUILTIN_SECRET_PATTERNS (oauth_creds.json,
  credentials*, id_rsa*, *.pem, *.key, .ssh/**) and
  _BUILTIN_NOISE_PATTERNS (.claude/**/*.meta.json) are always applied;
  user config cannot disable or negate them.
• User slot — new IndexingConfig.exclude_patterns: list[str]
  (gitignore syntax via pathspec). Registered in MUTABLE_FIELDS +
  FIELD_CONSTRAINTS so CLI (mm config set), MCP (mem_config), and the
  future Web UI share one validation path.
• Built-in and user specs are separate PathSpec instances — a user
  !negation only affects the user spec, so security invariants hold
  regardless of user config.
• Case-insensitive matching (lowercase on both pattern and candidate).
• _EXCLUDED_DIRS extended with .aws, .ssh, .gnupg for directory-
  level secret stores.

New CLI

mm purge --matching-excluded            # dry-run
mm purge --matching-excluded --apply    # actually delete

Scans storage.get_all_source_files() against the current exclude set
(built-in + user) and deletes matching chunks via delete_by_source.
Needed because the denylist applies retroactively only to new indexing
runs — existing chunks for secret files would otherwise remain.

Scope notes

• Naming delta from feat(indexing,security): user-configurable exclude_patterns + built-in secret denylist #225: the issue spec said mm mem purge, but the
  existing CLI is flat (mm add, mm recall, mm reset, ...) with no
  mem subgroup. Registered as mm purge to match conventions.
  Functionally identical.
• Out of scope (per feat(indexing,security): user-configurable exclude_patterns + built-in secret denylist #225, follow-up): Web UI editor in
  settings-config.js, .gitignore file discovery.

Test plan

• uv run ruff check packages/memtomem/src packages/memtomem/tests
• uv run ruff format --check packages/memtomem/src packages/memtomem/tests
• uv run pytest -m "not ollama" — 1575 passed, 46 deselected
• 17 new tests covering:
  • Built-in secret & noise patterns block at discovery
  • User patterns honored (positive + negation)
  • Security regression: user !**/oauth_creds.json cannot unset
    built-in secret patterns
  • Case-insensitive matching
  • Directory-level .aws/.ssh/.gnupg excluded
  • mm purge --matching-excluded dry-run does not delete;
    --apply calls delete_by_source
  • No-match branch reports clean
• Manual: mm purge --matching-excluded against a dev DB with existing
  Claude Code subagent meta chunks — verify sample output and --apply
  removal.

Migration note (in CHANGELOG)

Existing users with auto-discovered AI tool directories in memory_dirs
should run mm purge --matching-excluded to clean up chunks that predate
this change. Without it, credential chunks already stored remain
searchable and exportable.

Closes #225 (PR (a)).