MCPUserGuard.MCPDispatch now sets the in-memory credential's ID to the
subject's TokenID when the subject came from a personal usr_ token (no
ClientID), so a handler running under MCP dispatch can record which
token made a change. An OAuth subject's TokenID names the OAuth
server's token row, so its credential keeps ID 0. The credential is
still never saved.
- TestBackendLink: the fresh sign-in rule at the second, 1:1 on the
frontend side, the show route's three keys, SetLink and RemoveLink events
(none after a rollback), deactivated or deleted administrators, and
deactivating the frontend user
- TestFrontendPermissionCatalog: a second plugin's duplicate and an empty
code dropped; a group saved with a declared code grants it
- TestUserMCPGuard: parser refusals, a soft-deleted user, an expired token,
and the dispatch credential against the route's own user.scope:read
