refactor(routes): one supersession seam for REST and MCP; PUT/PATCH notes share a handler; shared mask/not-found/caller helpers (#2829, milestone 296 area 5)

Reading the 28 route modules against each other and against the MCP tools:
- routes/notes.py carried a PUT and a PATCH handler that were the same
  function minus the supersedes contract on one of them — one handler now
  serves both verbs, so both carry it.
- The two _attach_supersession copies (REST + MCP) become
  supersession_svc.attach_relations(uid, note_id, data, hint=) — the seam
  the two surfaces must agree through; only the agent surface adds the
  one-sentence reading hint.
- Three local _uid() wrappers over g.user.id → scribe.auth.get_current_user_id
  like every other module; design_systems' private _not_found → routes.utils.
  not_found; the four "********" literals → settings_svc.SECRET_MASK with the
  read/write contract written once.
- routes/plugin.py: the project_id/repo resolution block and the
  comma-separated id parse were copied into three endpoints — _project_scope()
  and _int_list() now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/mcp/tools/systems.py

@@ -134,7 +134,7 @@ async def attach_systems(
     tagged record shows its areas (the touching-a-System reflex needs the
     affiliation visible on read, not just settable on write), an untagged
     project record carries the question instead. Neither field is ever
-    attached empty (same reasoning as notes._attach_supersession / #2483 — a
+    attached empty (same reasoning as supersession_svc.attach_relations / #2483 — a
     field that always says nothing trains readers to skip fields). The hint
     goes only to the record's owner: tagging someone else's record in someone
     else's project is not the caller's call to make. Fail-open — decoration