refactor: rename package fabledassistant -> scribe (code-only)

Renames src/fabledassistant -> src/scribe and all imports, plus the
default DB name and DB user/password (fabled -> scribe) in config +
compose. 952 refs / 154 files. Reverses the old 'internal name stays
fabledassistant' convention.

Code-only: live databases are still physically named 'fabledassistant'.
Deployed environments must set POSTGRES_DB / POSTGRES_USER (or rename the
DB) since the defaults now resolve to 'scribe'. Repo (FabledScribe), git
host (fabledsword), MCP (fabled-git) and the image name (fabledscribe)
are intentionally unchanged.

ruff check src/ clean locally; CI (typecheck + pytest) is the gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/scribe/auth.py

@@ -0,0 +1,59 @@
+import functools
+
+from quart import g, jsonify, request, session
+
+from scribe.services.auth import get_user_by_id
+from scribe.services.api_keys import lookup_key
+
+
+def _check_auth(f, required_role: str | None = None):
+    @functools.wraps(f)
+    async def decorated(*args, **kwargs):
+        # --- Bearer token path ---
+        auth_header = request.headers.get("Authorization", "")
+        if auth_header.startswith("Bearer "):
+            raw_key = auth_header[len("Bearer "):]
+            api_key = await lookup_key(raw_key)
+            if api_key is None:
+                return jsonify({"error": "Invalid or revoked API key"}), 401
+            user = await get_user_by_id(api_key.user_id)
+            if not user:
+                return jsonify({"error": "User not found"}), 401
+            # Scope enforcement: read-only keys cannot mutate
+            if api_key.scope == "read" and request.method not in ("GET", "HEAD", "OPTIONS"):
+                return jsonify({"error": "Read-only key cannot perform write operations"}), 403
+            # Role check (admin_required routes)
+            if required_role and user.role != required_role:
+                return jsonify({"error": "Admin access required"}), 403
+            g.user = user
+            g.api_key = api_key
+            return await f(*args, **kwargs)
+
+        # --- Session path (unchanged) ---
+        user_id = session.get("user_id")
+        if not user_id:
+            return jsonify({"error": "Authentication required"}), 401
+        user = await get_user_by_id(user_id)
+        if not user:
+            session.clear()
+            return jsonify({"error": "Authentication required"}), 401
+        if session.get("session_version") != user.session_version:
+            session.clear()
+            return jsonify({"error": "Session expired. Please log in again."}), 401
+        if required_role and user.role != required_role:
+            return jsonify({"error": "Admin access required"}), 403
+        g.user = user
+        return await f(*args, **kwargs)
+    return decorated
+
+
+def login_required(f):
+    return _check_auth(f)
+
+
+def admin_required(f):
+    return _check_auth(f, required_role="admin")
+
+
+def get_current_user_id() -> int:
+    return g.user.id