fix(01-05): enforce MCP health read scope

- require health:read or wildcard for MCP read capability
- reject insufficient scopes before downstream gates and server construction

src/app/mcp/route.ts

@@ -45,7 +45,11 @@
  */
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
-import { createMcpServer, resolveMcpAuthContext } from "@/lib/mcp";
+import {
+  createMcpServer,
+  resolveMcpAuthContext,
+  SCOPE_HEALTH_READ,
+} from "@/lib/mcp";
 import { withBackgroundEvent } from "@/lib/logging/background";
 import { annotate } from "@/lib/logging/context";
 import { isModuleEnabled } from "@/lib/modules/gate";
@@ -163,6 +167,14 @@ async function handleMcp(request: Request): Promise<Response> {
       return unauthorized(request);
     }
 
+    // Authorization is distinct from credential validity. A write-only or
+    // unrelated bearer is still a real token, but it must not reach rate
+    // limiting, module discovery, server construction, or any health reader.
+    if (!ctx.canRead) {
+      annotate({ action: { name: "mcp.auth.insufficient_scope" } });
+      return unauthorized(request, SCOPE_HEALTH_READ);
+    }
+
     // 2. RATE LIMIT — per `<userId>:<tokenId>` credential binding.
     const rl = await checkMcpRateLimit(ctx.binding);
     if (!rl.allowed) {