authn: name the grant scope dolt.sr.ht/DATABASES

api-meta.json published the scope as lowercase "repos" while every other
service on the instance publishes it upper case — git.sr.ht/REPOSITORIES,
todo.sr.ht/TRACKERS, paste.sr.ht/PASTES, builds.sr.ht/JOBS. Upstream derives
those from a GraphQL enum; this service has no @access directive to derive
from, so the spelling was free and drifted.

It matters because meta.sr.ht compares the string verbatim. Its oauth2
blueprint fetches every service's api-meta.json once at import time and
validates a requested grant with `scope in service_scopes[svc]` — no case
folding, no aliasing. So a grant typed by hand as dolt.sr.ht/REPOS:RO was
refused, by analogy with every neighbouring service.

DATABASES rather than REPOS: that is what the surface calls the object
everywhere a user meets it — the GraphQL databases connection, the web pages,
the docs. The storage layer underneath still says "repo"; renaming that is a
deeper change and is not what a token grant names.

No backward compatibility. auth.Grants.Has is a map lookup, so a PAT minted
against the old spelling is refused rather than quietly honoured, and two table
cases assert that instead of leaving it implied. Deploying this is two-sided:
meta.sr.ht has to be restarted before anyone can mint a token carrying the new
name.

The federation gateway is unaffected — it forwards the client's Authorization
header to each service and never reads api-meta.json.

sr-ht-dolt-xic

log: replace logrus with slog behind auxilia's scribe handler

Every logger field this service owned was a *logrus.Entry threaded
through a constructor, which is what logrus costs for want of a usable
default. They are slog.Default().With("component", ...) now, and the
threading is gone with them; the shared middleware's panic reports land
in the same handler, which is why the daemon sets the default before
anything that can fail.

The handler is scribe's tint handler: level from [dolt.sr.ht]log-level,
source positions, and masks keyed on the attribute path for the three
credentials this service handles — the unified-login cookie, the
Internal fernet token and the Authorization header the remotesapi reads
a PAT or a keypair JWT out of. Errors go through scribe.Err, so a culpa
error's hint reaches the operator on its own line.

logrus stays in go.mod: dolt's remotesrv.ServerArgs takes a
*logrus.Entry and nothing else. It is now confined to Config.DoltLogger,
which is the only place this service names it.

dolt-git-hook is deliberately untouched: what it writes to stderr is the
notice a pushing user reads through git, not a log.

feat(remoteapi): auto-create databases on first push to own namespace

Push-to-create: an authenticated, non-suspended caller pushing (or
cloning) an unknown repo under their OWN namespace has it transparently
created — a PRIVATE repository row plus a genuinely empty on-disk NBS
store — then proceeds through the normal ACL check as the owner. Any
other case (anonymous, suspended, another user's namespace, invalid
name) still returns NotFound, so a stranger's namespace is never leaked
and nothing is created.

storage.InitEmptyStore creates the store WITHOUT WriteEmptyRepo: an
"Initialize data repository" commit would make the client's first push a
non-fast-forward and be rejected. An empty store (root = empty hash) lets
the initial push land as the repo's first history. The interceptor
auto-create is race-safe (ErrNameTaken re-fetch) and rolls the row back
if the store cannot be created.

Proven end-to-end (integration): a real `dolt push` to a new name
auto-creates PRIVATE + fast-forwards + re-clones; a foreign-namespace
push is denied with no row created. All prior clone/push/ACL scenarios
still pass.

rename module to sourcecraft.dev/bigbes/sr-ht-dolt; depend on sourcecraft sr-ht-core

remoteapi: authz interceptors, remotesrv assembly, credentials service