feat(plugin): write-path trigger — offer prior art before code is rewritten

The milestone headline. Auto-inject fires on the operator's prompt; the
moment reuse is actually lost is later, when the agent decides mid-task to
write a helper. A PreToolUse hook on Write|Edit now fires there.

Channel: `additionalContext` with NO permissionDecision, so the note reaches
Claude beside the tool result and the write is never blocked — a recall aid
must not be able to stop the operator's work. Plain stdout would have been
invisible to the model, and deny/ask would have made a nudge into a gate.

Two arms, different in kind:
- BY PLACE — a snippet recorded at this path (or its directory) is prior art
  by definition, not resemblance, so it is neither scored nor thresholded.
  This is what #2083's reverse lookup was built to answer.
- BY MEANING — semantic search restricted to snippets (new `note_type` filter
  on semantic_search_notes) over the code about to be written.
Place ranks first; the top-k cap spans both arms.

Gates carried over from milestone 93 verbatim: threshold, margin, session
dedup, titles-never-bodies. Own `source='write_path'` in retrieval_logs so
precision is tunable separately — the docstring records that the place arm
is unlogged and hands that to #2085.

Its own on/off in Settings but the SAME threshold/top-k: one "how loud may
Scribe be" knob is easier to reason about than two that drift, and splitting
them later is then a data-backed change rather than a guess.

Details worth keeping: the hook sends a REPO-RELATIVE path because that is
how locations are recorded; the git remote resolves to a project and is never
used as the location `repo` filter (different namespaces, would silently
match nothing); the endpoint stays a GET because a read-scoped API key cannot
POST and every other hook depends on that.

plugin.json 0.1.17 -> 0.1.18. Refs #2082, milestone #232.

src/scribe/routes/plugin.py

@@ -99,6 +99,53 @@ async def autoinject_retrieve():
     return jsonify(result)
 
 
+@plugin_bp.get("/prior-art")
+@login_required
+async def write_path_prior_art():
+    """Prior-art hint for the plugin's PreToolUse hook on Write/Edit.
+
+    Answers "what is already recorded for the file about to be written?" — by
+    place (a snippet at this path or in its directory) and by meaning (snippets
+    resembling the code about to be written). Titles only, gated, and empty most
+    of the time. See services.plugin_context.build_write_path_hint.
+
+    Query:
+        path (str)         — the target file, REPO-RELATIVE, matching the
+                             convention snippet locations are recorded in. An
+                             absolute path simply won't match anything.
+        code (optional)    — the code about to be written; the semantic query.
+                             Omit it and only the location arm runs.
+        repo (optional)    — working repo remote; resolved to the bound project
+                             to scope the search, exactly as /retrieve does. It
+                             is NOT used as the location `repo` filter — see the
+                             service docstring for why those two differ.
+        project_id (opt)   — explicit project scope override (ad-hoc/testing).
+        exclude_ids (opt)  — comma-separated ids already surfaced this session.
+    """
+    path = (request.args.get("path") or "").strip()
+    code = request.args.get("code") or ""
+    try:
+        project_id = int(request.args.get("project_id", 0) or 0)
+    except (TypeError, ValueError):
+        project_id = 0
+
+    repo = (request.args.get("repo") or "").strip()
+    if repo and not project_id:
+        resolved = await repo_bindings_svc.resolve_project(g.user.id, repo)
+        if resolved:
+            project_id = resolved
+
+    exclude_ids = [
+        int(p) for p in (request.args.get("exclude_ids") or "").split(",")
+        if p.strip().isdigit()
+    ]
+
+    result = await plugin_ctx_svc.build_write_path_hint(
+        g.user.id, path, code=code, project_id=project_id, exclude_ids=exclude_ids
+    )
+    return jsonify(result)
+
+
 @plugin_bp.get("/processes")
 @login_required
 async def process_manifest():