pub(crate) const MCP_SCOPE: &str = "mcp.read";
OAuth scope advertised for the MCP endpoints. Not enforced server-side (authorization is at the SQL layer via RBAC).