feat(plugin): resolve session project from git remote, not a pinned project_id

The SessionStart hook asked for a project_id via plugin userConfig, which pins
one install to a single project — wrong for an operator working across many
repos/projects. Resolve the active project server-side from the working repo's
git remote instead (a stable identifier, not a dir-name guess).

- repo_bindings table (migration 0064) + RepoBinding model: (user, repo_key) ->
  project, FKs CASCADE.
- services/repo_bindings: normalize_repo_key collapses ssh/https/scp/creds/port/
  .git to host/owner/repo; resolve/set/list/delete.
- GET /api/plugin/context takes ?repo=<remote>; unbound repo -> a "bind this
  repo" hint with a ready bind_repo() call. project_id kept as manual override.
- MCP tools: bind_repo / list_repo_bindings / unbind_repo.
- Hook sends ?repo=$(git remote get-url origin) URL-encoded; all project_id
  handling removed. plugin.json drops the project_id userConfig (0.1.2 -> 0.1.3).
- Tests: normalize equivalence classes + unbound-hint rendering.

Refs task 755 (Scribe-as-plugin push channel).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/scribe/services/plugin_context.py

@@ -40,9 +40,19 @@ async def _topic_titles(topic_ids: set[int]) -> dict[int, str]:
         return {tid: title for tid, title in rows.all()}
 
 
-async def build_session_context(user_id: int, project_id: int = 0) -> dict:
+async def build_session_context(
+    user_id: int, project_id: int = 0, unbound_repo: str = ""
+) -> dict:
     """Render the SessionStart context for a user, optionally project-scoped.
 
+    Args:
+        user_id: the operator.
+        project_id: the resolved active project (0 = none). The endpoint
+            resolves this from the working repo's remote, not from config.
+        unbound_repo: when the hook sent a repo remote that maps to no project,
+            its normalized key — triggers a one-line "bind this repo" hint so
+            the binding is self-healing.
+
     Returns {"context": str, "rule_count": int, "project": dict | None}.
     `context` is markdown ready to drop into `additionalContext`; it is capped
     at _MAX_CHARS with an explicit truncation note so the hook can pass it
@@ -86,6 +96,16 @@ async def build_session_context(user_id: int, project_id: int = 0) -> dict:
                 f"Goal: {goal[:200]}" if goal else "",
                 f"Open todo tasks: {open_count}",
             ]
+    elif unbound_repo:
+        lines += [
+            "",
+            "## Repository not yet bound",
+            f"This repo (`{unbound_repo}`) isn't mapped to a Scribe project, so "
+            "no project context was loaded. Bind it once with "
+            f'`bind_repo(repo_url="{unbound_repo}", project_id=<id>)` '
+            "(call `list_projects` to find the id) and future sessions here will "
+            "auto-load that project's context.",
+        ]
 
     lines += [
         "",