Block a user
Misleading auth log:
static_token_mismatch reported for token_type: "jwt" when the JWT validator is unavailable
JWT validator init is one-shot at startup — IdP unavailable during co-boot degrades auth permanently and silently
ingestion: retry OIDC discovery instead of exiting on cold-boot 502
Surface aging brain/raw/ pending notes instead of relying on someone remembering to check
Add brain_reject: brain/raw/ pending notes can only be promoted, never discarded
Add missing MCP tools: label create/edit/delete + richer label_list, issue dependencies, typed not-found for file_read