feat(plugin): resolve session project from git remote, not a pinned project_id

The SessionStart hook asked for a project_id via plugin userConfig, which pins
one install to a single project — wrong for an operator working across many
repos/projects. Resolve the active project server-side from the working repo's
git remote instead (a stable identifier, not a dir-name guess).

- repo_bindings table (migration 0064) + RepoBinding model: (user, repo_key) ->
  project, FKs CASCADE.
- services/repo_bindings: normalize_repo_key collapses ssh/https/scp/creds/port/
  .git to host/owner/repo; resolve/set/list/delete.
- GET /api/plugin/context takes ?repo=<remote>; unbound repo -> a "bind this
  repo" hint with a ready bind_repo() call. project_id kept as manual override.
- MCP tools: bind_repo / list_repo_bindings / unbind_repo.
- Hook sends ?repo=$(git remote get-url origin) URL-encoded; all project_id
  handling removed. plugin.json drops the project_id userConfig (0.1.2 -> 0.1.3).
- Tests: normalize equivalence classes + unbound-hint rendering.

Refs task 755 (Scribe-as-plugin push channel).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_services_plugin_context.py

@@ -55,6 +55,25 @@ async def test_build_session_context_includes_project_when_scoped():
     assert "Open todo tasks: 4" in out["context"]
 
 
+@pytest.mark.asyncio
+async def test_build_session_context_unbound_repo_emits_bind_hint():
+    with patch("scribe.services.plugin_context.rulebooks_svc.list_always_on_rules",
+               AsyncMock(return_value=[_rule(1, "rule", 1)])), \
+         patch("scribe.services.plugin_context._topic_titles",
+               AsyncMock(return_value={1: "git-workflow"})):
+        from scribe.services.plugin_context import build_session_context
+        out = await build_session_context(
+            user_id=7, project_id=0, unbound_repo="host/owner/repo",
+        )
+
+    ctx = out["context"]
+    assert out["project"] is None
+    assert "## Repository not yet bound" in ctx
+    assert 'bind_repo(repo_url="host/owner/repo"' in ctx
+    # No project block when unbound.
+    assert "## Active project" not in ctx
+
+
 @pytest.mark.asyncio
 async def test_build_session_context_caps_length():
     many = [_rule(i, "x" * 200, 1) for i in range(200)]

tests/test_services_repo_bindings.py

@@ -0,0 +1,41 @@
+import pytest
+
+from scribe.services.repo_bindings import normalize_repo_key
+
+
+@pytest.mark.parametrize(
+    "raw",
+    [
+        "git@git.fabledsword.com:bvandeusen/fabledscribe.git",
+        "git@git.fabledsword.com:bvandeusen/FabledScribe.git",
+        "https://git.fabledsword.com/bvandeusen/fabledscribe.git",
+        "https://git.fabledsword.com/bvandeusen/fabledscribe",
+        "http://git.fabledsword.com/bvandeusen/fabledscribe.git",
+        "ssh://git@git.fabledsword.com:22/bvandeusen/fabledscribe.git",
+        "ssh://git@git.fabledsword.com/bvandeusen/fabledscribe",
+        "https://user:token@git.fabledsword.com/bvandeusen/fabledscribe.git",
+    ],
+)
+def test_normalize_collapses_equivalent_remotes(raw):
+    assert normalize_repo_key(raw) == "git.fabledsword.com/bvandeusen/fabledscribe"
+
+
+@pytest.mark.parametrize("raw", ["", "   ", None])
+def test_normalize_empty_inputs(raw):
+    assert normalize_repo_key(raw) == ""
+
+
+def test_normalize_distinguishes_different_repos():
+    a = normalize_repo_key("git@host:owner/repo-a.git")
+    b = normalize_repo_key("git@host:owner/repo-b.git")
+    assert a == "host/owner/repo-a"
+    assert b == "host/owner/repo-b"
+    assert a != b
+
+
+def test_normalize_preserves_nested_group_path():
+    # GitLab-style nested namespaces must survive normalization.
+    assert (
+        normalize_repo_key("https://gitlab.com/group/subgroup/repo.git")
+        == "gitlab.com/group/subgroup/repo"
+    )