feat(issues): S2 MCP tools — system CRUD + issue/system wiring

Second slice of Issues + Systems (spec #825).

New mcp/tools/systems.py: create_system, list_systems, get_system (records
split into issues/tasks/notes), update_system (incl. archive via status),
list_system_records (kind/open_only filters), delete_system. Registered in
register_all; read tools (get_system, list_systems, list_system_records) added
to the read-only-key allowlist (write tools default-deny).

create_task/update_task: kind now accepts 'issue'; new system_ids (set-semantics
associations) and arose_from_id (provenance, 0=unchanged/-1=clear) args.
create_note/update_note: new system_ids arg (notes associate with systems too).
services/notes.create_note: arose_from_id passthrough (update_note already
handles it via setattr).

Tests: MCP system tools + create_task issue-wiring (kind/provenance/systems),
service layer mocked.

Refs plan 825 (S2).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/scribe/services/notes.py

@@ -65,6 +65,7 @@ async def create_note(
     note_type: str = "note",
     entity_meta: dict | None = None,
     task_kind: str = "work",
+    arose_from_id: int | None = None,
 ) -> Note:
     # Validate status/priority here so the MCP create_task path (which passes
     # them straight through) can't persist an out-of-enum value that the REST
@@ -108,6 +109,7 @@ async def create_note(
             note_type=note_type,
             entity_meta=entity_meta,
             task_kind=task_kind,
+            arose_from_id=arose_from_id,
         )
         session.add(note)
         await session.commit()