feat(phase-4a): groups sync + X-Project-Key header substrate

Foundational work for the upcoming group-scoped sharing feature.

Schema (migration 0003_groups.sql + drizzle schema):
  - memory_access enum ('ro' | 'rw') reserved for Agent B's project_shares
  - groups (id, oidc_iss, name, display_name, …) keyed by (oidc_iss, name)
    so different IdPs can both have e.g. "platform" without colliding
  - user_groups (user_id, group_id, synced_at) PK (user_id, group_id)

Auth (auth.ts + lib/auth/sync-groups.ts):
  - jwt callback now syncs `profile.groups` after upserting the user
  - syncUserGroupsFromClaim runs in a single tx: upserts each group,
    inserts new memberships, deletes ones no longer in the claim
  - missing/empty claim → user has zero groups (wipe memberships)
  - EntraID GUID-vs-name edge case: we treat whatever strings the claim
    emits as names verbatim; groups overage (>200 groups → no claim)
    is documented as unsupported in v1

UserContext + JWT (lib/mcp/context.ts, lib/auth/jwt.ts):
  - AuthenticatedClaims.groups surfaced from verified JWT payload
  - UserContext.groups: string[] — live from OIDC token claim, falls
    back to DB snapshot for CLI (HMAC) tokens which carry no claim
  - UserContext.defaultProjectKey: optional, set from header

MCP route (app/api/mcp/route.ts):
  - reads X-Project-Key header, validates against ProjectKey Zod schema,
    400 on invalid; empty/missing leaves defaultProjectKey undefined
  - auto-upserts the header-supplied project so first-use works without
    a separate project.identify call

Tools (lib/mcp/tools.ts):
  - withDefaultProject helper injects ctx.defaultProjectKey when the
    caller omits `project`. Per-tool defaultScope hint avoids breaking
    snippet.put (user-scope default) while making memory.write
    (project-scope default) honor the header
  - applied to memory.write/list/search/update and all snippet.* tools

Web UI:
  - /settings/groups debug page lists current memberships with synced_at
    and a clear empty state pointing at README troubleshooting
  - /settings/tokens grows a "Pin to project" dropdown; selected key is
    baked into the generated `claude mcp add` snippet as
    `--header "X-Project-Key: <key>"`. The JWT itself stays
    identity-only — pinning is purely a UX shortcut
  - settings landing page links to /settings/groups
  - README troubleshooting bullet covers the empty-groups path for
    Authentik / EntraID / Keycloak

Refactor:
  - extracted resolveProjectId + upsertProject from memory-actions.ts
    into lib/projects.ts so the MCP route can reuse upsertProject

Verification:
  - pnpm typecheck clean
  - SKIP_ENV_VALIDATION=true pnpm build clean; /settings/groups in route table

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/(authed)/settings/tokens/tokens-manager.tsx

@@ -4,19 +4,35 @@ import { useActionState } from "react";
 import { Button } from "@/app/_components/ui/button";
 import { Input, Label } from "@/app/_components/ui/input";
 
-interface State {
+/**
+ * State returned by the `createTokenAction` server action.
+ *
+ * `projectKey` is the project the user chose to pin the token to. It's NOT
+ * baked into the JWT itself — the token remains identity-only — it just
+ * lets us bake `--header "X-Project-Key: <key>"` into the generated
+ * `claude mcp add` snippet so calls from this client default to that
+ * project without the model having to pass it explicitly.
+ */
+export interface CreateTokenState {
   token: string | null;
   error: string | null;
+  projectKey: string | null;
+}
+
+export interface ProjectOption {
+  key: string;
+  displayName: string | null;
 }
 
 interface Props {
-  action: (prev: State, formData: FormData) => Promise<State>;
+  action: (prev: CreateTokenState, formData: FormData) => Promise<CreateTokenState>;
   ttlDays: number;
+  projects: ProjectOption[];
 }
 
-const initial: State = { token: null, error: null };
+const initial: CreateTokenState = { token: null, error: null, projectKey: null };
 
-export default function TokensManager({ action, ttlDays }: Props) {
+export default function TokensManager({ action, ttlDays, projects }: Props) {
   const [state, formAction, pending] = useActionState(action, initial);
 
   if (state.token) {
@@ -33,12 +49,18 @@ export default function TokensManager({ action, ttlDays }: Props) {
         </pre>
         <details className="text-xs text-fg-muted">
           <summary className="cursor-pointer">claude mcp add command</summary>
-          <pre className="mt-2">{`claude mcp add --transport http --scope user \\
-  --header "Authorization: Bearer ${state.token}" \\
-  shared-memory https://memory.dnspegasus.net/api/mcp`}</pre>
+          <pre className="mt-2">{buildMcpAddSnippet(state.token, state.projectKey)}</pre>
         </details>
         <p className="text-xs text-fg-subtle">
           Valid for {ttlDays} days. Revoke individually below if it leaks.
+          {state.projectKey ? (
+            <>
+              {" "}This token is pinned to project{" "}
+              <code className="font-mono">{state.projectKey}</code> via the{" "}
+              <code className="font-mono">X-Project-Key</code> header in the
+              snippet above — the JWT itself is identity-only.
+            </>
+          ) : null}
         </p>
       </div>
     );
@@ -56,6 +78,10 @@ export default function TokensManager({ action, ttlDays }: Props) {
           autoComplete="off"
         />
       </div>
+      <div className="flex-1 min-w-[200px]">
+        <Label htmlFor="projectKey" hint="optional">Pin to project</Label>
+        <ProjectSelect projects={projects} />
+      </div>
       <Button type="submit" disabled={pending}>
         {pending ? "Generating…" : "Generate token"}
       </Button>
@@ -65,3 +91,43 @@ export default function TokensManager({ action, ttlDays }: Props) {
     </form>
   );
 }
+
+function ProjectSelect({ projects }: { projects: ProjectOption[] }) {
+  // Match Input styling — Tailwind v4 classes from `lib/ui/input.tsx`.
+  const cls =
+    "mt-1 block w-full h-9 px-3 text-sm rounded-md bg-surface-1 " +
+    "border border-border text-fg focus:border-accent-400 focus:outline-none " +
+    "disabled:opacity-50 transition-colors";
+
+  if (projects.length === 0) {
+    return (
+      <select id="projectKey" name="projectKey" className={cls} disabled>
+        <option value="">No projects yet</option>
+      </select>
+    );
+  }
+  return (
+    <select id="projectKey" name="projectKey" defaultValue="" className={cls}>
+      <option value="">(none — token works across all projects)</option>
+      {projects.map((p) => (
+        <option key={p.key} value={p.key}>
+          {p.displayName && p.displayName !== p.key
+            ? `${p.key} — ${p.displayName}`
+            : p.key}
+        </option>
+      ))}
+    </select>
+  );
+}
+
+function buildMcpAddSnippet(token: string, projectKey: string | null): string {
+  const headerLines = [`  --header "Authorization: Bearer ${token}"`];
+  if (projectKey) {
+    headerLines.push(`  --header "X-Project-Key: ${projectKey}"`);
+  }
+  return [
+    "claude mcp add --transport http --scope user \\",
+    ...headerLines.map((l) => `${l} \\`),
+    "  shared-memory https://memory.dnspegasus.net/api/mcp",
+  ].join("\n");
+}