feat(plugin): resolve session project from git remote, not a pinned project_id

The SessionStart hook asked for a project_id via plugin userConfig, which pins
one install to a single project — wrong for an operator working across many
repos/projects. Resolve the active project server-side from the working repo's
git remote instead (a stable identifier, not a dir-name guess).

- repo_bindings table (migration 0064) + RepoBinding model: (user, repo_key) ->
  project, FKs CASCADE.
- services/repo_bindings: normalize_repo_key collapses ssh/https/scp/creds/port/
  .git to host/owner/repo; resolve/set/list/delete.
- GET /api/plugin/context takes ?repo=<remote>; unbound repo -> a "bind this
  repo" hint with a ready bind_repo() call. project_id kept as manual override.
- MCP tools: bind_repo / list_repo_bindings / unbind_repo.
- Hook sends ?repo=$(git remote get-url origin) URL-encoded; all project_id
  handling removed. plugin.json drops the project_id userConfig (0.1.2 -> 0.1.3).
- Tests: normalize equivalence classes + unbound-hint rendering.

Refs task 755 (Scribe-as-plugin push channel).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/scribe/routes/plugin.py

@@ -12,6 +12,7 @@ from quart import Blueprint, g, jsonify, request
 
 from scribe.auth import admin_required, get_current_user_id, login_required
 from scribe.services import plugin_context as plugin_ctx_svc
+from scribe.services import repo_bindings as repo_bindings_svc
 from scribe.services.settings import get_admin_setting, set_setting
 
 plugin_bp = Blueprint("plugin", __name__, url_prefix="/api/plugin")
@@ -25,16 +26,33 @@ _MARKETPLACE_KEY = "plugin_marketplace_url"
 @plugin_bp.get("/context")
 @login_required
 async def session_context():
-    """Return SessionStart context (always-on rules + optional project).
+    """Return SessionStart context (always-on rules + active project).
 
-    Query: project_id (optional int) — when set, includes that project's goal
-    and open-task count. The hook passes the bound project's id here.
+    Query:
+        repo (optional str) — the working repo's git remote. The server
+            resolves it to the bound project (see services/repo_bindings); an
+            unbound repo yields a "bind this repo" hint instead. This is how the
+            active project is determined — the plugin never pins a project id.
+        project_id (optional int) — explicit override, mainly for manual/ad-hoc
+            curl testing; takes precedence over `repo` when set.
     """
     try:
         project_id = int(request.args.get("project_id", 0) or 0)
     except (TypeError, ValueError):
         project_id = 0
-    result = await plugin_ctx_svc.build_session_context(g.user.id, project_id)
+
+    unbound_repo = ""
+    repo = (request.args.get("repo") or "").strip()
+    if repo and not project_id:
+        resolved = await repo_bindings_svc.resolve_project(g.user.id, repo)
+        if resolved:
+            project_id = resolved
+        else:
+            unbound_repo = repo_bindings_svc.normalize_repo_key(repo)
+
+    result = await plugin_ctx_svc.build_session_context(
+        g.user.id, project_id, unbound_repo=unbound_repo
+    )
     return jsonify(result)