docs: clarify Daedalus-Pallas integration auth model

Refine the phase-2 integration spec to reflect implementation details:

- Change `resolved_libraries` from `set[str]` to ordered `list[str]`
- Document `MCPToken.allowed_libraries` as JSONField (not M2M) since
  Library lives in Neo4j, not Django's ORM
- Clarify that `Library.workspace_id` is a content-routing attribute,
  not an authorization axis
- Describe retirement of the three-branch `_WORKSPACE_SCOPE_CLAUSE` in
  favor of a single `lib.uid IN $resolved_libraries` check
- Specify team JWT resolution via `TeamWorkspaceAssignment` DB join
- Note admin UI materializes full Library UID list explicitly

mnemosyne/mcp_server/views.py

@@ -28,12 +28,13 @@ def mcp_token_list(request: HttpRequest) -> HttpResponse:
 @require_http_methods(["GET", "POST"])
 def mcp_token_create(request: HttpRequest) -> HttpResponse:
     if request.method == "POST":
-        form = MCPTokenCreateForm(request.POST)
+        form = MCPTokenCreateForm(request.POST, user=request.user)
         if form.is_valid():
             token, plaintext = MCPToken.objects.create_token(
                 user=request.user,
                 name=form.cleaned_data["name"],
                 allowed_tools=form.cleaned_data.get("allowed_tools") or [],
+                allowed_libraries=form.cleaned_data.get("allowed_libraries") or [],
                 expires_at=form.cleaned_data.get("expires_at") or None,
             )
             return render(
@@ -42,7 +43,7 @@ def mcp_token_create(request: HttpRequest) -> HttpResponse:
                 {"token": token, "plaintext": plaintext},
             )
     else:
-        form = MCPTokenCreateForm()
+        form = MCPTokenCreateForm(user=request.user)
 
     return render(request, "mcp_server/tokens/create.html", {"form": form})
 
@@ -60,15 +61,18 @@ def mcp_token_edit(request: HttpRequest, pk: int) -> HttpResponse:
     token = get_object_or_404(MCPToken, pk=pk, user=request.user)
 
     if request.method == "POST":
-        form = MCPTokenEditForm(request.POST, instance=token)
+        form = MCPTokenEditForm(request.POST, instance=token, user=request.user)
         if form.is_valid():
             instance = form.save(commit=False)
             instance.allowed_tools = form.cleaned_data.get("allowed_tools") or []
+            instance.allowed_libraries = (
+                form.cleaned_data.get("allowed_libraries") or []
+            )
             instance.save()
             messages.success(request, "MCP token updated.")
             return redirect("mcp_server:mcp-token-detail", pk=token.pk)
     else:
-        form = MCPTokenEditForm(instance=token)
+        form = MCPTokenEditForm(instance=token, user=request.user)
 
     return render(
         request, "mcp_server/tokens/edit.html", {"form": form, "token": token}