feat(500): the reply shapes become server product content - a compact core and per-kind slices, each tied to its moment (#5493)

services/reply_shapes.py is the single source of the default reply shapes:
the core (every reply, ~1,800 chars against a 2,200 budget) and three
slices - completion on work.finish, asks on reply.ask, plan on work.plan.
Read through list_reply_shapes (MCP, read-only) and GET
/api/retrieval/reply-shapes, one service behind both doors.

Nothing delivers them yet; that is step 3. The skill still carries its
copy until step 4 shrinks it to the long-form reference.

The software-only vocabulary guard moves into tests/helpers.py
(DEV_ONLY, dev_only_hits) rather than becoming a fourth copy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/routes/retrieval.py

@@ -20,6 +20,7 @@ from quart import Blueprint, jsonify, request
 from scribe.auth import get_current_user_id, login_required
 from scribe.services import moment_actions as moment_actions_svc
 from scribe.services import moments as moments_svc
+from scribe.services import reply_shapes as shapes_svc
 from scribe.services import rule_moment_judgments as judgments_svc
 from scribe.services import rulebooks as rulebooks_svc
 from scribe.services.retrieval_telemetry import moment_usage
@@ -143,6 +144,17 @@ async def moments_route():
     return jsonify(out)
 
 
+@retrieval_bp.route("/reply-shapes", methods=["GET"])
+@login_required
+async def reply_shapes_route():
+    """The default reply shapes and the moment each rides (milestone 500).
+
+    The same payload `list_reply_shapes` returns, from the same service, so
+    the Settings view and the session cannot show different defaults.
+    """
+    return jsonify(shapes_svc.catalog())
+
+
 async def _mapping_change(change):
     """map/unmap from the browser: the MCP tools' service, recorded as human.