feat(plugin): knowledge auto-inject (Path A) — title-first per-turn awareness

New UserPromptSubmit hook (scribe_autoinject.sh) + GET /api/plugin/retrieve that
surface the TITLES (never bodies) of the few notes clearing four anti-bloat
gates: a per-user confidence threshold (stricter than pull search), a margin
gate, per-session dedup (exclude_ids), and a top-k ceiling. Each retrieval is
logged to retrieval_logs as source=auto_inject so the threshold can be tuned
from data. Per-user config (enable / threshold / top-k) is DB-backed via
/api/settings with a Settings UI card; defaults enabled, threshold 0.55,
top-k 3 (conservative — tune once auto_inject telemetry accrues).

Scribe: project 2, milestone 93, task 1033.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xz4j1H7pjYSjKsEpgcNH5E

src/scribe/routes/plugin.py

@@ -57,6 +57,48 @@ async def session_context():
     return jsonify(result)
 
 
+@plugin_bp.get("/retrieve")
+@login_required
+async def autoinject_retrieve():
+    """Title-first knowledge auto-inject for the plugin's UserPromptSubmit hook.
+
+    Given the user's prompt (`q`), returns a compact awareness hint — note
+    titles + scores only, never bodies — for the top hits that clear the
+    per-user gates (see services.plugin_context.build_autoinject_hint). Returns
+    empty context (most of the time) when disabled or nothing is relevant.
+
+    Query:
+        q (str)            — the user's prompt to retrieve against.
+        repo (optional)    — working repo remote; resolved to the bound project
+                             to scope the search (mirrors /context). Unbound or
+                             absent → searches all the user's notes.
+        project_id (opt)   — explicit project scope override (ad-hoc/testing).
+        exclude_ids (opt)  — comma-separated note ids already injected this
+                             session; skipped so each note injects at most once.
+    """
+    q = (request.args.get("q") or "").strip()
+    try:
+        project_id = int(request.args.get("project_id", 0) or 0)
+    except (TypeError, ValueError):
+        project_id = 0
+
+    repo = (request.args.get("repo") or "").strip()
+    if repo and not project_id:
+        resolved = await repo_bindings_svc.resolve_project(g.user.id, repo)
+        if resolved:
+            project_id = resolved
+
+    exclude_ids = [
+        int(p) for p in (request.args.get("exclude_ids") or "").split(",")
+        if p.strip().isdigit()
+    ]
+
+    result = await plugin_ctx_svc.build_autoinject_hint(
+        g.user.id, q, project_id=project_id, exclude_ids=exclude_ids
+    )
+    return jsonify(result)
+
+
 @plugin_bp.get("/processes")
 @login_required
 async def process_manifest():