feat(family): platforms declared at inception and detected from bound repos (milestone 463 step 2, #4988)

A project's platforms decide which family ideas reach it. This step makes membership answerable from every door:

- services/platforms.py: the global catalog (writes are admin-only and duplicate-gated by slug); pure marker detection; and membership reads and writes. Detection only ADDS, and only where nobody has answered. It never overrides a declared or rejected row and never removes one.
- coverage: the archive scan now carries every path, and the refresh runs detection fail-open.
- inception: a platforms choice (slugs, or null for unanswered). The list is the whole answer: members left out of it become rejected.
- MCP: list_platforms and set_project_platforms; enter_project and get_project carry the project's platforms.
- REST: /api/platforms (admin writes) and /api/projects/<id>/platforms.
- UI: a platforms checklist on the inception card, a Family tab on ProjectView, and a Platforms admin tab in Settings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/services/canonical_systems.py

@@ -30,7 +30,6 @@ from sqlalchemy import select
 from scribe.models import async_session
 from scribe.models.canonical_system import CanonicalSystem
 from scribe.models.system import System
-from scribe.models.user import User
 from scribe.services import access
 
 logger = logging.getLogger(__name__)
@@ -60,9 +59,7 @@ def _tokens(slug: str) -> frozenset[str]:
 
 
 async def _is_admin(user_id: int) -> bool:
-    async with async_session() as session:
-        role = await session.scalar(select(User.role).where(User.id == user_id))
-    return role == "admin"
+    return await access.is_instance_admin(user_id)
 
 
 async def list_canonical_systems() -> list[CanonicalSystem]: