chore(provider): pin bifrost>=0.6.1 + affect-provider contract

Onboard ratatoskr as the Tier-3 Bifrost consumer (durable memory +
persona/affect persistence Worldtree writes into). Lands the dependency
and the reviewed affect-plane spec; no production code yet — the patch
bump fires when the store lands at TDD-green.

- pyproject: bifrost>=0.6.1 in a `provider` optional-extra (+ starlette,
  jsonschema); gitea PyPI index wired, bifrost sourced from it.
- uv.lock: bifrost 0.6.1 + jsonschema resolved from the gitea registry.
- docs/contracts/bifrost_affect_provider.contract.md: SQLite-backed,
  conduit-opaque affect store (emit + ASGI wiring). Heid-panel-reviewed
  (Groa/Hulda/Regin), amended for 8 text-ambiguity findings.

pyproject.toml

@@ -25,6 +25,14 @@ web = [
     "starlette>=0.40",
     "uvicorn[standard]>=0.30",
 ]
+# Tier-3 Bifrost consumer: the durable memory.* + affect.* persistence
+# provider Worldtree writes into. Opt-in extra — distinct deployment surface
+# from the debug TUI. Recipe: bifrost/docs/implementing-a-consumer.md.
+provider = [
+    "ratatoskr[web]",       # reuse the starlette + uvicorn ASGI stack
+    "bifrost>=0.6.1",       # consumer engines + library (0.6.0 yanked: circular import)
+    "jsonschema>=4",        # bifrost runtime dep — envelope validation
+]
 dev = [
     "pytest>=8",
     "pytest-asyncio>=0.24",
@@ -52,6 +60,15 @@ worldtree-spec-rev = "562001af28d752c3a60d449c7ddd09f44fa9dc9a"
 worldtree-version = "v0.29.0"
 pinned-on = "2026-05-26"
 
+# Bifrost lives on the auth-gated gitea PyPI index (not public PyPI).
+# uv reads the credential from UV_INDEX_GITEA_USERNAME / _PASSWORD or ~/.netrc.
+[[tool.uv.index]]
+name = "gitea"
+url = "https://gitea.phasefinal.com/api/packages/vh/pypi/simple/"
+
+[tool.uv.sources]
+bifrost = { index = "gitea" }
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/ratatoskr"]