refactor(mcp): one rules_payload() for every surface that hands rules to an agent; drop the dead bearer resolver (#2828, milestone 296 area 4)

Reading the 16 tool modules against each other: the six-key applicable-rules
block (applicable_rules, applicable_rules_truncated, subscribed_rulebooks,
project_rules, suppressed_rules, suppressed_topics) was hand-built in five
places — enter_project, get_project, get_task (legacy plans), get_milestone
(three of the six) and services/planning.start_planning. rulebooks_svc.
rules_payload() is now the one place that names them; get_milestone gains the
three it lacked, so every rules-carrying payload reads the same. list_rules /
list_always_on_rules share _rule_summary. mcp/auth.resolve_bearer_to_user_id
duplicated resolve_bearer's parsing and had no product caller (only its own
tests) — removed; the tests now exercise resolve_bearer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_mcp_auth.py

@@ -3,20 +3,20 @@ from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
-from scribe.mcp.auth import resolve_bearer, resolve_bearer_to_user_id
+from scribe.mcp.auth import resolve_bearer
 
 
 @pytest.mark.asyncio
 async def test_resolve_bearer_missing_header_returns_none():
-    assert await resolve_bearer_to_user_id(None) is None
+    assert await resolve_bearer(None) is None
 
 
 @pytest.mark.asyncio
 async def test_resolve_bearer_malformed_header_returns_none():
-    assert await resolve_bearer_to_user_id("Token abc") is None
-    assert await resolve_bearer_to_user_id("Bearer") is None
-    assert await resolve_bearer_to_user_id("Bearer ") is None
-    assert await resolve_bearer_to_user_id("") is None
+    assert await resolve_bearer("Token abc") is None
+    assert await resolve_bearer("Bearer") is None
+    assert await resolve_bearer("Bearer ") is None
+    assert await resolve_bearer("") is None
 
 
 @pytest.mark.asyncio
@@ -25,19 +25,20 @@ async def test_resolve_bearer_unknown_token_returns_none():
         "scribe.mcp.auth.lookup_key",
         AsyncMock(return_value=None),
     ):
-        assert await resolve_bearer_to_user_id("Bearer fmcp_doesnotexist") is None
+        assert await resolve_bearer("Bearer fmcp_doesnotexist") is None
 
 
 @pytest.mark.asyncio
 async def test_resolve_bearer_valid_token_returns_user_id():
     fake_key = MagicMock()
     fake_key.user_id = 42
+    fake_key.scope = "write"
     with patch(
         "scribe.mcp.auth.lookup_key",
         AsyncMock(return_value=fake_key),
     ):
-        uid = await resolve_bearer_to_user_id("Bearer fmcp_validkey")
-    assert uid == 42
+        uid, scope = await resolve_bearer("Bearer fmcp_validkey")
+    assert (uid, scope) == (42, "write")
 
 
 @pytest.mark.asyncio
@@ -45,13 +46,14 @@ async def test_resolve_bearer_calls_lookup_with_stripped_token():
     """The Bearer prefix and any trailing whitespace must be stripped before lookup."""
     fake_key = MagicMock()
     fake_key.user_id = 1
+    fake_key.scope = "write"
     mock_lookup = AsyncMock(return_value=fake_key)
     with patch("scribe.mcp.auth.lookup_key", mock_lookup):
-        await resolve_bearer_to_user_id("Bearer fmcp_abc123  ")
+        await resolve_bearer("Bearer fmcp_abc123  ")
     mock_lookup.assert_awaited_once_with("fmcp_abc123")
 
 
-# ── resolve_bearer (user_id + scope) ────────────────────────────────────
+# ── scope ───────────────────────────────────────────────────────────────
 
 @pytest.mark.asyncio
 async def test_resolve_bearer_returns_user_id_and_scope():