feat(19.7-02): pier MCP module tracer with in-process dispatch and sessions

- modules/pier: Host contract, mcp.* config, catalog compiled from
  pact.HasMCP (prefixing, route binding, guard resolution, schema
  reflection, annotations), per-request identity through the published
  verifier and resolvers, built-in backend guard provider, in-process
  dispatch with the bouncer marker, per-identity SDK server with the
  per-request re-filter, stateful session router with rehydration over a
  memory store, audit lines
- modules/surf/pier_on.go: the summercms_mcp hook adapting the router to
  pier.Host; the untagged hello binary carries no SDK
- go.mod: go-sdk v1.8.0 and jsonschema-go v0.4.3 (decision note committed
  before this change)
- TestPierTracerSmoke: SDK client lists and calls acme_echo end to end
  through surf's compiled guard chain; README and root table row

modules/pier/guards.go

@@ -0,0 +1,43 @@
+package pier
+
+import (
+	"fmt"
+	"strings"
+
+	"git.golem15.com/golem15/summercms/modules/backpack"
+	"git.golem15.com/golem15/summercms/modules/pact"
+)
+
+// guardRegistry returns the application's pact.MCPGuards registry,
+// publishing an empty one when no plugin did (find-or-publish).
+func guardRegistry(app *backpack.App) (*pact.MCPGuards, error) {
+	if reg, ok := app.Lookup[*pact.MCPGuards](); ok && reg != nil {
+		return reg, nil
+	}
+	reg := pact.NewMCPGuards()
+	if err := app.Publish(reg); err != nil {
+		return nil, fmt.Errorf("pier: publishing the guard registry: %w", err)
+	}
+	return reg, nil
+}
+
+// frontendGuardName picks the guard provider an OAuth grant's user acts
+// under: the one registered provider other than backend. None means OAuth
+// identities have no frontend subject (backend tools only, through the
+// link); more than one is a boot error, because a grant names no guard.
+func frontendGuardName(reg *pact.MCPGuards) (string, error) {
+	var names []string
+	for _, name := range reg.Names() {
+		if name != BackendGuard {
+			names = append(names, name)
+		}
+	}
+	switch len(names) {
+	case 0:
+		return "", nil
+	case 1:
+		return names[0], nil
+	default:
+		return "", fmt.Errorf("pier: several frontend guard providers are registered (%s); an OAuth grant can act under exactly one", strings.Join(names, ", "))
+	}
+}