feat(resolvemcp): require authentication on MCP endpoints and enforce model rules on writes

Guard() rejects unauthenticated callers (no guest/optional mode); Setup*/New* helpers take a
SecurityList and have explicit *Unauthenticated variants. Model rules now reach the security
hooks, create checks CanCreate (security.CheckModelCreateAllowed), create/update validate keys
against the model's writable columns, update sets only given keys (NULL allowed), update and
delete go through row security via a new BeforeScan hook, and the annotation tool is opt-in
(Config.EnableAnnotations) and runs BeforeHandle.

pkg/resolvemcp/security_hooks.go

@@ -62,6 +62,15 @@ func RegisterSecurityHooks(handler *Handler, securityList *security.SecurityList
 		return security.ApplyRowSecurity(newSecurityContext(hookCtx), securityList)
 	})
 
+	// BeforeScan: row-level security on the row an update or delete targets. A row the user
+	// cannot see is "not found" and is never written.
+	handler.Hooks().Register(BeforeScan, func(hookCtx *HookContext) error {
+		if err := security.LoadSecurityRules(newSecurityContext(hookCtx), securityList); err != nil {
+			return err
+		}
+		return security.ApplyRowSecurity(newSecurityContext(hookCtx), securityList)
+	})
+
 	// AfterRead (1st): apply column-level security — mask/hide columns in the result.
 	handler.Hooks().Register(AfterRead, func(hookCtx *HookContext) error {
 		return security.ApplyColumnSecurity(newSecurityContext(hookCtx), securityList)
@@ -72,6 +81,11 @@ func RegisterSecurityHooks(handler *Handler, securityList *security.SecurityList
 		return security.LogDataAccess(newSecurityContext(hookCtx))
 	})
 
+	// BeforeCreate: enforce CanCreate rule.
+	handler.Hooks().Register(BeforeCreate, func(hookCtx *HookContext) error {
+		return security.CheckModelCreateAllowed(newSecurityContext(hookCtx))
+	})
+
 	// BeforeUpdate: enforce CanUpdate rule.
 	handler.Hooks().Register(BeforeUpdate, func(hookCtx *HookContext) error {
 		return security.CheckModelUpdateAllowed(newSecurityContext(hookCtx))