feat(32.1-01): publish one MCP scope list and call context

- pact gains MemberTokenScopeCatalog, MCPAdvertisedScopes and MCPCall
- an empty MCP ScopesSupported resolves to the five fixed names including backend
- pier copies advertised scopes and sets MCPCall beside WithDispatch

modules/pact/mcp.go

@@ -139,6 +139,40 @@ type MCPSubject struct {
 	TokenID  uint
 }
 
+// mcpCallKey is the unexported context key of an MCPCall. A plain HTTP
+// request never carries one.
+type mcpCallKey struct{}
+
+// MCPCall is one in-process MCP tool call. Subject is the subject pier
+// resolved for the tool's guard, not an expansion of its scopes. SessionID
+// is the MCP session id, empty on the stateless path and when the call was
+// served without a session. Tool is the exposed tool name.
+type MCPCall struct {
+	Subject   MCPSubject
+	SessionID string
+	Tool      string
+}
+
+// WithMCPCall stores call on ctx. A nil ctx is returned as nil: the
+// dispatch context is never nil, and this does not invent a background
+// context.
+func WithMCPCall(ctx context.Context, call MCPCall) context.Context {
+	if ctx == nil {
+		return nil
+	}
+	return context.WithValue(ctx, mcpCallKey{}, call)
+}
+
+// MCPCallFrom returns the MCPCall on ctx. ok is false when ctx is nil or
+// carries none, including a plain HTTP request.
+func MCPCallFrom(ctx context.Context) (MCPCall, bool) {
+	if ctx == nil {
+		return MCPCall{}, false
+	}
+	call, ok := ctx.Value(mcpCallKey{}).(MCPCall)
+	return call, ok
+}
+
 // MCPDispatch is a guard provider's answer for one in-process call: the
 // principal (a *bouncer.Principal, carried as any so pact stays free of
 // bouncer), the optional credential stored next to it, and the bouncer
@@ -224,6 +258,22 @@ type MCPTokenVerifier interface {
 	MCPResource() string
 }
 
+// MCPAdvertisedScopes is implemented by a verifier that publishes the scopes
+// the MCP authorization server advertises. pier copies MCPScopesSupported
+// into protected-resource metadata when the slice is non-empty, and
+// otherwise keeps its own fallback list. It is a separate interface so
+// MCPTokenVerifier stays MCPVerifyToken and MCPResource.
+type MCPAdvertisedScopes interface {
+	MCPScopesSupported() []string
+}
+
+// MemberTokenScopeCatalog is the compiled member personal-token scope list,
+// published by the plugin that owns member tokens. The method is not named
+// FrontendTokenScopes: HasFrontendTokenScopes already has that method.
+type MemberTokenScopeCatalog interface {
+	MemberTokenScopes() []FrontendTokenScope
+}
+
 // MCPGrant is a verified OAuth access token: the frontend user, the client,
 // the token row, the granted scopes, the expiry and, for a grant carrying
 // the backend scope, the backend account the user consented to.