fix(extraction): R11 container 503 + R12 shared prompt module

R11: POST /admin/extract-batch with mode=llm now returns 503 when the
claude CLI is unavailable (was silently returning success with 0
candidates), with a message pointing at the host-side script. +2 tests.

R12: extracted SYSTEM_PROMPT + parse_llm_json_array +
normalize_candidate_item + build_user_message into stdlib-only
src/atocore/memory/_llm_prompt.py. Both the container extractor and
scripts/batch_llm_extract_live.py now import from it, eliminating the
prompt/parser drift risk.

Tests 297 -> 299.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/test_extraction_pipeline.py

@@ -171,3 +171,38 @@ def test_llm_extraction_failure_returns_empty(tmp_data_dir, monkeypatch):
     # Nothing in the candidate queue
     queue = get_memories(status="candidate", limit=10)
     assert len(queue) == 0
+
+
+def test_extract_batch_api_503_when_cli_missing(tmp_data_dir, monkeypatch):
+    """R11: POST /admin/extract-batch with mode=llm must fail loud when
+    the `claude` CLI is unavailable, instead of silently returning a
+    success-with-0-candidates payload (which masked host-vs-container
+    truth for operators)."""
+    from fastapi.testclient import TestClient
+    from atocore.main import app
+    import atocore.api.routes as routes
+
+    init_db()
+    monkeypatch.setattr(routes, "_llm_cli_available", lambda: False)
+
+    client = TestClient(app)
+    response = client.post("/admin/extract-batch", json={"mode": "llm"})
+
+    assert response.status_code == 503
+    assert "claude" in response.json()["detail"].lower()
+
+
+def test_extract_batch_api_rule_mode_ok_without_cli(tmp_data_dir, monkeypatch):
+    """Rule mode must still work when the LLM CLI is missing — R11 only
+    affects mode=llm."""
+    from fastapi.testclient import TestClient
+    from atocore.main import app
+    import atocore.api.routes as routes
+
+    init_db()
+    monkeypatch.setattr(routes, "_llm_cli_available", lambda: False)
+
+    client = TestClient(app)
+    response = client.post("/admin/extract-batch", json={"mode": "rule"})
+
+    assert response.status_code == 200