feat: MCP tools for posts, categories and tags, the draft_post prompt

- journal.Plugin.MCP: list_posts, show_post, list_categories, list_tags,
  create_post, update_post, delete_post and the draft_post prompt, guard
  backend, listed with golem15.journal.access_posts; update fields are
  optional so only sent keys reach the route
- optionalBackendPrincipal honours the MCP dispatch marker (no bearer
  short-circuit; anonymous reads unchanged)
- require summercms v0.4.4
- TestJournalMCPSmoke, TestOptionalBackendPrincipalDispatch

controllers/api/auth.go

@@ -63,11 +63,14 @@ func resolveError(w http.ResponseWriter, err error) {
 	writeAuthRequired(w, err)
 }
 
-// optionalBackendPrincipal verifies a backend JWT or personal API token only
-// when Authorization Bearer is present. Failure is anonymous: public GET must
-// not 401. Uses cabana.ResolveBackend with cover golem15.journal.*.
+// optionalBackendPrincipal verifies a backend JWT or personal API token when
+// one is presented, and honours the in-process dispatch marker the MCP
+// endpoint sets (no Authorization header then, D-17). Failure is anonymous:
+// public GET must not 401 (ResolveBackend answers ErrUnauthenticated for a
+// request without a bearer). Uses cabana.ResolveBackend with cover
+// golem15.journal.*.
 func optionalBackendPrincipal(app *backpack.App, r *http.Request) *http.Request {
-	if r == nil || !hasBearer(r) {
+	if r == nil {
 		return r
 	}
 	out, _, err := cabana.ResolveBackend(app, r, journalCover)