feat(scribe): merge_snippets — unify found one-off snippets into one canonical

Step 2 of the snippet-merge milestone (#231). The dedup gate only PREVENTS
new near-duplicates; merge is the CURE for the ones already scattered.

- services/snippets.py: merge_snippets(user_id, target_id, source_ids) —
  keep the target's scalar fields (name/when_to_use/signature/language/
  code), union the sources' locations + extra tags onto it (so the survivor
  carries every call site as a location), trash the sources (recoverable),
  re-embed the survivor. Pure merge_snippet_fields() factored out for unit
  testing. Returns (survivor_note, merged_ids).
- mcp/tools/snippets.py: merge_snippets(target_id, source_ids) tool (5th),
  and a create_snippet dedup-path nudge toward merge over a forced copy.
- routes/snippets.py: POST /api/snippets/<id>/merge {source_ids} — share-
  aware (can_write target + every source, rule #78) with a same-owner guard
  (cross-owner merge is out of scope).
- plugin reusing-code skill + MCP _INSTRUCTIONS: point found-duplicates at
  merge as the cure (rule #119 surfaces, not a Scribe rule). plugin.json
  0.1.13 -> 0.1.14 in the same change (the #1040 marketplace-ship lesson).
- Tests: pure merge-helper union/dedup; MCP tool (requires a source,
  survivor+merged_ids, not-found); route handler + 5-tool registration.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pa2EsuB54BuWQ8GfJq9c7t

src/scribe/routes/snippets.py

@@ -120,6 +120,46 @@ async def update_snippet_route(snippet_id: int):
     return jsonify(snippets_svc.snippet_to_dict(updated))
 
 
+@snippets_bp.route("/<int:snippet_id>/merge", methods=["POST"])
+@login_required
+async def merge_snippet_route(snippet_id: int):
+    """Unify source snippets into this one (the canonical target). Body:
+    {"source_ids": [int, ...]}. Requires write on the target and every source,
+    and all must share the target's owner (cross-owner merge is out of scope)."""
+    uid = get_current_user_id()
+    loaded = await _load_snippet(uid, snippet_id)
+    if loaded is None:
+        return not_found("Snippet")
+    target, _ = loaded
+    if not await can_write_note(uid, snippet_id):
+        return jsonify({"error": "Permission denied"}), 403
+
+    data = await request.get_json() or {}
+    raw = data.get("source_ids") or []
+    source_ids = [s for s in raw if isinstance(s, int) and s != snippet_id]
+    if not source_ids:
+        return jsonify({"error": "source_ids (non-empty list of other snippet ids) is required"}), 400
+
+    owner_uid = target.user_id
+    for sid in source_ids:
+        sloaded = await _load_snippet(uid, sid)
+        if sloaded is None:
+            return not_found(f"Snippet {sid}")
+        snote, _ = sloaded
+        if snote.user_id != owner_uid:
+            return jsonify({"error": "can only merge snippets with the same owner"}), 400
+        if not await can_write_note(uid, sid):
+            return jsonify({"error": f"Permission denied for snippet {sid}"}), 403
+
+    result = await snippets_svc.merge_snippets(owner_uid, snippet_id, source_ids)
+    if result is None:
+        return not_found("Snippet")
+    note, merged_ids = result
+    out = snippets_svc.snippet_to_dict(note)
+    out["merged_ids"] = merged_ids
+    return jsonify(out)
+
+
 @snippets_bp.route("/<int:snippet_id>", methods=["DELETE"])
 @login_required
 async def delete_snippet_route(snippet_id: int):