fix(mcp): validate the write preview so it matches the commit outcome

The confirm:false preview echoed the would-be record without running the
type / range / instant validation, so a preview could show a value the
commit then refused. Run the same shared validation in the preview and
surface wouldFail with the error + reason the commit would return, so a
preview and its commit never disagree.

Also note at the REST read-method allowlist that the MCP-audience guard
assumes GET/HEAD/OPTIONS are side-effect-free — a future side-effecting
GET must revisit that audience binding.

src/lib/api-handler.ts

@@ -16,6 +16,11 @@ import { SCOPE_HEALTH_READ, SCOPE_HEALTH_WRITE } from "./mcp/oauth/config";
 /**
  * HTTP methods a read-only credential may use on the REST surface. A request
  * with any other method (POST / PUT / PATCH / DELETE) is a write.
+ *
+ * The MCP-audience guard below assumes these methods are side-effect-free:
+ * an MCP-bound token is admitted on them. A future side-effecting GET (or HEAD)
+ * would silently widen that token's reach over REST — do NOT add one without
+ * revisiting the MCP audience binding here.
  */
 const READ_HTTP_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);