fix(pier): widen returning identities, warm the Redis store, end stateless listen streams, refuse personal tokens without a TokenID

- Identity.fingerprint covers scopes, both subjects, the ceiling and the
  token kind; a stateful lookup or stateless hit whose fingerprint changed
  re-filters the server with the event diff under its own mutex (A-WR-04)
- Mount warms a Redis store in the background with a 1 s to 30 s backoff
  and every request kicks a pending open without waiting, so stateless-only
  instances subscribe to fan-out (A-WR-05)
- a stateless subscriptions/listen POST re-verifies its bearer every
  recheck interval; an LRU-evicted stateless server closes its sessions
  (A-WR-06)
- resolvePersonalToken refuses a subject with TokenID 0, and the
  pact.MCPPersonalTokenResolver contract says one resolver per application,
  false means unauthorized and TokenID keys the binding (A-WR-09, A-IN-03)

modules/pact/README.md

@@ -157,7 +157,7 @@ func (p *Plugin) Schedule() []pact.ScheduledCommand {
 | `pact.MCPSubject` | The identity an MCP session acts as under one guard: guard name, user id, granted scopes, OAuth client id and personal token id. |
 | `pact.MCPDispatch` | A guard provider's answer for one call: the principal (as `any`), an optional credential and the bouncer guard names that honour the dispatch marker. |
 | `pact.MCPTokenVerifier` | Published by the OAuth server plugin: verifies an access token at the MCP endpoint into a `pact.MCPGrant` (user, client, token, scopes, expiry) and names its resource. A refused token is `pact.ErrMCPTokenInvalid`. |
-| `pact.MCPPersonalTokenResolver` | Published by a plugin whose personal tokens may open an MCP session: resolves a raw token into a `pact.MCPSubject`, false when the prefix is not its own. |
+| `pact.MCPPersonalTokenResolver` | Published by the one plugin whose personal tokens may open an MCP session (one resolver per application): resolves a raw token into a `pact.MCPSubject` whose `TokenID` identifies the token row (it keys the session binding; a subject without one is refused); false when the prefix is not its own, which the endpoint answers as unauthorized. |
 | `pact.MCPLinkedBackendResolver` | Published by the plugin that owns the frontend-to-backend account link: the `pact.LinkedBackendUser` (id, login, display name) of a frontend user, false when unlinked. |
 | `pact.MCPSubjectChanged` | Event fired on the festival bus when a subject's permissions, link, grants or existence change (`Kind` is `pact.MCPSubjectPermissions`, `pact.MCPSubjectLink`, `pact.MCPSubjectRevoked` or `pact.MCPSubjectDeleted`), so the MCP endpoint re-lists tools or ends sessions. |
 | `pact.FrontendPermission` | One frontend permission code a plugin declares: `Code`, `Label`, `Tab` and `Comment`, offered in the user plugin's permission editors next to the seeded codes. |

modules/pact/mcp.go

@@ -236,9 +236,13 @@ var ErrMCPTokenInvalid = errors.New("pact: mcp token invalid")
 
 // MCPPersonalTokenResolver resolves a personal API token (a frontend user
 // token; the admin's g15_ tokens are resolved by the framework) into an MCP
-// subject. The boolean is false when the token's prefix is not the
-// resolver's, so the next resolver is tried; an error means the token has
-// this resolver's prefix but is not usable.
+// subject. An application has one resolver, published through app.Lookup
+// by the plugin that owns the frontend tokens. The boolean is false when
+// the token's prefix is not the resolver's, and the endpoint then answers
+// unauthorized; an error means the token has this resolver's prefix but is
+// not usable. The subject's UserID and TokenID must both be set: TokenID
+// identifies the token row and keys the session binding
+// (pat:user:<TokenID>), so a subject without a TokenID is refused.
 type MCPPersonalTokenResolver interface {
 	MCPResolvePersonalToken(ctx context.Context, raw string) (MCPSubject, bool, error)
 }