test(ingestion): /mcp's JWT validator and resource_metadata; narrow comments

PR #183 review (comment 15474):
- TestBuildMuxAnswers503ToAJWTOnMCPWhileTheIssuerIsUnresolved: building
  /mcp's middleware with a nil validator turns it red.
- TestBuildMuxMCP401CarriesResourceMetadataInWWWAuthenticate: building it
  with resourceMetadataURL "" turns it red.
- main.go, routes.go and the testMux comment now say exactly what is
  untested: main's restAuth fields and public map passed to buildMux, and
  ListenAndServe (hyperguild#182). Stale public-route list in the
  TestBuildMuxDoesNotWrapPublicRoutes comment corrected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/cmd/server/main.go

@@ -587,8 +587,10 @@ func main() {
 	//
 	// The whole router, /mcp's bearer included, is built in buildMux so its
 	// tests are tests of production wiring (PR #152 review, hyperguild#154).
-	// The REST API's credential is the same as /mcp's. ListenAndServe below
-	// must serve its result unchanged: that one line is the untested part.
+	// The REST API's credential is the same as /mcp's. Untested here: the
+	// restAuth fields and the public map this call passes in (e.g. a nil
+	// validator would drop JWT auth on /mcp and REST and the suite stays
+	// green), and ListenAndServe serving the result unchanged (hyperguild#182).
 	handler, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
 		resourceMetadataURL: resourceMetadataURL}, h, mcpSrv, metrics.New(), public)
 	if err != nil {