authn: name the grant scope dolt.sr.ht/DATABASES

api-meta.json published the scope as lowercase "repos" while every other
service on the instance publishes it upper case — git.sr.ht/REPOSITORIES,
todo.sr.ht/TRACKERS, paste.sr.ht/PASTES, builds.sr.ht/JOBS. Upstream derives
those from a GraphQL enum; this service has no @access directive to derive
from, so the spelling was free and drifted.

It matters because meta.sr.ht compares the string verbatim. Its oauth2
blueprint fetches every service's api-meta.json once at import time and
validates a requested grant with `scope in service_scopes[svc]` — no case
folding, no aliasing. So a grant typed by hand as dolt.sr.ht/REPOS:RO was
refused, by analogy with every neighbouring service.

DATABASES rather than REPOS: that is what the surface calls the object
everywhere a user meets it — the GraphQL databases connection, the web pages,
the docs. The storage layer underneath still says "repo"; renaming that is a
deeper change and is not what a token grant names.

No backward compatibility. auth.Grants.Has is a map lookup, so a PAT minted
against the old spelling is refused rather than quietly honoured, and two table
cases assert that instead of leaving it implied. Deploying this is two-sided:
meta.sr.ht has to be restarted before anyone can mint a token carrying the new
name.

The federation gateway is unaffected — it forwards the client's Authorization
header to each service and never reads api-meta.json.

sr-ht-dolt-xic

mcpsrv: list_issues names every clipped table it drew from

Data.Truncated/ShownOf only ever meant the issues/dependencies read that
decides list_issues' total and truncated, so a clipped labels table took
label pills off every card and narrowed the label filter in silence, and a
clipped custom_statuses table could put a card in the wrong lane with
table_truncated still reading false.

list_issues now carries beads.Data.Clipped as clipped: one entry per
clipped table in read order, named, with the rows read against the rows
that exist and what that specific clip costs this listing. table_truncated
and table_total are unchanged; clipped is additive, an empty list on a
complete read.

mcpsrv: report the projection's clip on get_issue and list_milestones

Max clips every table read at 2000 rows. list_issues has always said so
(table_truncated, table_total); the other two answers computed over the
same read said nothing, so a rollup over a prefix of the tracker read as
arithmetic about the whole of it, and an id in the tail of a big tracker
was answered "no such issue" — a claim neither read can support.

get_issue now carries the two fields on every answer and splits the
miss: a complete read keeps the plain refusal, a clipped one says the id
was not among the rows read, names the cap and the true total, and ships
the payload (issue: null beside table_truncated) so the two misses are
one field apart rather than one adjective apart. list_milestones carries
the same two fields.

mcpsrv: answer a real NULL as null

mcpsrv: name the cursor a commit-log miss was asked about

mcpsrv: a bad commit-log cursor is a miss, not a fault

mcpsrv: answer what is ready across every tracker

mcpsrv: list the memories a tracker holds

mcpsrv: add the beads tools

mcpsrv: add the generic browse tools

mcpsrv: serve a stateless read-only MCP surface