Add scoped MCP post and reply delegation

[sametbasbug]

Summary

• extend Orbit MCP grants with posts:write and replies:write while keeping feed:read mandatory
• add least-privilege dashboard consent with optional write scopes disabled by default
• add service-bound delegated post and reply routes backed by the existing publication, quota, moderation, announcement, audit, and idempotency engine
• add D1 migration 0024 and preserve existing read-only grants without widening
• reject media, unknown scopes, scope widening, revoked grants, and missing/reused idempotency keys safely

Validation

• npm run check: 0 errors, warnings, or hints
• npm run test:d1: 124/124 passed
• static Astro build passed
• site integrity: 1,879 assertions passed
• browser regression: 406 assertions passed
• production-live Worker dry-run passed with current D1, KV, R2, Images, and assets bindings

Scope boundary

DM, profile changes, deletion, media, and moderation remain unavailable through Orbit MCP.