feat(brain): stamp server-owned write provenance; surface it in brain_query

brain_write was an ungated, durable prompt-injection path: a session that
just read an untrusted page could write an entry every later session
retrieves as trusted guidance (OWASP MCP06). Decision (#145): tag
provenance rather than stage writes.

Every write and update stamps origin (static | jwt | unknown) and
written_by (the authenticated principal) into frontmatter. Server-owned:
origin/written_by in caller content or an update fragment are discarded,
so a caller cannot claim a more trusted origin. No principal stamps
origin: unknown, never silence. brain_update re-stamps to the last
writer. capture (the claude.ai connector door) stamps too, via a new
server-derived CaptureContext.AuthPath set by both capture doors after
decode. REST POST /write carries no principal and stamps unknown.

brain_query results carry origin/written_by when the note has them;
older notes omit them rather than fabricate. brain_get already returns
frontmatter.

Refs #145

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/mcp/audit.go

@@ -12,13 +12,7 @@ import (
 // ended. Brain content is never copied into the record — only its size — so
 // the audit trail does not become a second, unscrubbed copy of the brain.
 func logToolCall(ctx context.Context, name string, args json.RawMessage, start time.Time, err error) {
-	principal, origin := "", "unknown"
-	if info, ok := ctx.Value(principalKey).(principalInfo); ok {
-		principal, origin = info.principal, "jwt"
-		if info.viaStatic {
-			origin = "static"
-		}
-	}
+	origin, principal := provenanceFrom(ctx)
 	attrs := []any{
 		"tool", name,
 		"principal", principal,