v0.13.10 - OAuth scopes enforced and atomic blueprint writes

Security

• MCP tools are filtered by the OAuth token's scopes. A token holding only entries:read can no longer list or call entries_delete, domains_delete, subscriptions_checkout and so on; a tool the token may not use is absent from tools/list and answers Tool not found. Tokens with the broad mcp scope (the default) and non-OAuth API tokens are unaffected.
• New optional scopes: domains:read/write, events:read/write, contexts:read/write, subscriptions:read/write, support:read/write. Search, preview and theme tools require the scopes of what they read.

Changes

• blueprints_save, globals_save and the REST blueprint endpoints validate the entire fields list before writing. An unparseable fields value is an error (it previously deleted every field), an unknown type is an error (previously dropped silently), duplicate handles are rejected, and dry_run: true writes nothing (it previously replaced fields, and for globals created a permanent blueprint). fields: [] still means "remove all fields"; omitting fields leaves them alone.
• REST: a blueprint update whose root fails validation no longer loses its fields; creating a collection with an inline blueprint on a taken handle no longer returns 201 with no schema; a failed global create no longer leaves a stray blueprint.