docs: update wiki to reflect the #450 2-scope model (read/write)
Several pages still described the pre-#450 four-tier scope model
(content.read/content.write/site.admin/system.admin with mcp as the
only alias) as if it were still active. Since #450 the server enforces
exactly two scopes, read and write, with every older scope string
accepted only as a compatibility alias.
Home, Documentation-Source-of-Truth, OAuth-Clients-and-Scopes,
Scope-and-Tool-Matrix, Pitfalls-Index, Client-Compatibility, and
Smoke-Tests-and-Live-Verification updated to describe the current
model as current, with the old model kept only as historical context
where relevant.
Pitfall-Anonymous-vs-Authenticated-Server rewritten more substantially:
it described a four-MCP-server-instance architecture
(anonServer/readServer/writeServer/siteAdminServer) that no longer
exists in the code -- the server now runs two instances
(publicServer/writeServer), and read-only tools that used to require
content.read (validate_site, build_agent_context, etc.) are fully
ungated since #450, not just relabeled.
Security-Proof-Client-Credential-Isolation gets a terminology note
rather than a rewrite -- the security property it demonstrates
(redirect URI isolation blocks cross-client credential reuse) is
scope-model-independent, so the historical scope names are left
in place with a pointer to the current model.
docs: add invalid-scope pitfall alias and changelog gate
docs: add release tag drift pitfall
docs: add wiki source-of-truth and smoke runbooks