feat(32.1-01): publish one MCP scope list and call context

- pact gains MemberTokenScopeCatalog, MCPAdvertisedScopes and MCPCall
- an empty MCP ScopesSupported resolves to the five fixed names including backend
- pier copies advertised scopes and sets MCPCall beside WithDispatch

modules/pier/stateless.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"git.golem15.com/golem15/summercms/modules/towel"
+	"github.com/modelcontextprotocol/go-sdk/auth"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 )
 
@@ -102,6 +103,13 @@ func (sp *statelessPath) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	use := &entryUse{}
 	r = r.WithContext(context.WithValue(r.Context(), entryUseKey{}, use))
 	defer sp.release(use)
+	// The stateless path has no MCP session. Mark the call before the
+	// handler runs so a synthesized SDK session id is not copied into it.
+	if ti := auth.TokenInfoFromContext(r.Context()); ti != nil && ti.Extra != nil {
+		info, _ := ti.Extra[extraCall].(callInfo)
+		info.stateless = true
+		ti.Extra[extraCall] = info
+	}
 	if r.Method != http.MethodPost || r.Body == nil {
 		sp.handler.ServeHTTP(w, r)
 		return