Identity and write binding

Read tools are project-scoped by the authenticated credential. Mutations have an additional binding check so a client cannot accidentally write through the wrong server instance or project.

The binding compares three values:

Field	Must match
resource	configured MCP resource
instance_id	selected HeyAira instance
project_id	authenticated project

The read-only server_identity call lets a client inspect the selected identity. It does not turn an untrusted response into permission to write. The client must obtain its expected profile from the operator-controlled connection configuration.