refactor(routes): one supersession seam for REST and MCP; PUT/PATCH notes share a handler; shared mask/not-found/caller helpers (#2829, milestone 296 area 5)

Reading the 28 route modules against each other and against the MCP tools:
- routes/notes.py carried a PUT and a PATCH handler that were the same
  function minus the supersedes contract on one of them — one handler now
  serves both verbs, so both carry it.
- The two _attach_supersession copies (REST + MCP) become
  supersession_svc.attach_relations(uid, note_id, data, hint=) — the seam
  the two surfaces must agree through; only the agent surface adds the
  one-sentence reading hint.
- Three local _uid() wrappers over g.user.id → scribe.auth.get_current_user_id
  like every other module; design_systems' private _not_found → routes.utils.
  not_found; the four "********" literals → settings_svc.SECRET_MASK with the
  read/write contract written once.
- routes/plugin.py: the project_id/repo resolution block and the
  comma-separated id parse were copied into three endpoints — _project_scope()
  and _int_list() now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/scribe/services/settings.py

@@ -8,6 +8,13 @@ from scribe.models.user import User
 
 logger = logging.getLogger(__name__)
 
+# What a stored credential looks like on the wire. Every surface that READS a
+# secret (smtp_password, forge_webhook_secret, a forge token) returns this
+# when one is set; every surface that WRITES one treats this value coming back
+# as "unchanged", never as a request to store eight asterisks over the real
+# credential. One constant so the read and write halves cannot disagree.
+SECRET_MASK = "********"
+
 
 async def get_admin_setting(key: str, default: str = "") -> str:
     """Read an instance-global setting (one stored on an admin account).

src/scribe/services/supersession.py

@@ -181,3 +181,35 @@ async def superseded_ids(note_ids: list[int]) -> set[int]:
             .where(NoteSupersession.superseded_id.in_(note_ids))
         )).scalars().all()
     return {int(r) for r in rows}
+
+
+SUPERSEDED_HINT = (
+    "A later note claims to bring this up to date — see superseded_by. "
+    "Read this as what was true when written, and check the newer one "
+    "before acting on it."
+)
+
+
+async def attach_relations(user_id: int, note_id: int, data: dict, *, hint: bool = False) -> None:
+    """Add both directions of the supersession relation to a note payload.
+
+    ONE seam for the REST and MCP surfaces, which must agree about what a
+    note's payload says — or the web UI and the agent would disagree about
+    whether a record is current. Both directions, because they answer
+    different questions and only one is obvious: `supersedes` is what the
+    author claimed; `superseded_by` is what a READER needs and what the note
+    itself cannot know — a stale record handed over without that marker gets
+    acted on confidently, which is worse than never surfacing it.
+
+    Omitted entirely when empty, so an ordinary note's payload doesn't grow
+    two permanently-empty lists (#2483 — a field that always says nothing
+    trains readers to skip fields). `hint=True` (the agent surface) also
+    attaches `superseded_note`, the one-sentence reading instruction.
+    """
+    rel = await get_relations(user_id, note_id)
+    if rel["supersedes"]:
+        data["supersedes"] = rel["supersedes"]
+    if rel["superseded_by"]:
+        data["superseded_by"] = rel["superseded_by"]
+        if hint:
+            data["superseded_note"] = SUPERSEDED_HINT