Consolidate the duplicated ACL role-update loops into one helper that
owns UUID key canonicalization, and tighten two review-round comments.

Two accepted spellings of one UUID collapse to a single canonical key,
so conflicting roles were resolved by map iteration order. Rekey the
request maps canonically during validation and return 400 when two
keys collapse to the same principal.

The ACL PATCH handler mapped every non-authorization transaction error
to 500, so a config deleted between the middleware fetch and the locked
re-fetch surfaced as an internal error. Map the not-found case to the
same concealed 404 the update and delete handlers return.

Add godoc to the new exported ACL types and client methods, note that
the down migration cannot remove the share scope enum value, and
regenerate the TypeScript types that carry the comments.

Main claimed 000567, shifting the stack's migrations by one.

Main claimed 000568, shifting the audit migration to 000570.

Force On previously loaded the forced set with daemon scope, so a
member the server's ACL denies still received its tools in every
chat. The forced query now runs as the chat owner and the dbauthz
post-filter drops servers the owner cannot read.

… from pre-ACL replicas

During a rolling upgrade a pre-ACL replica's insert omits both ACL
columns, so the '{}' defaults would hide the new server from every
ordinary member. A BEFORE INSERT trigger backfills the same Everyone
grant the application applies when both ACLs are empty.

Follows the audit migration's move to 000571 after main took 000569.

…ure doc

Chatd architecture prose must be written by the human PR author, so
leave a scoped TODO listing the owner ACL evaluation points and
invariants the new section must cover.

The full-view list fetch bypasses row authorization with system access,
so a key scoped only to mcp_server_config:update or audit_log:read could
read config data its scope does not cover. Keep roles deciding full-view
eligibility, but require the API key scope itself to permit reading MCP
server configs before bypassing row authorization.

Upgrades run in scheduled maintenance downtime with the database locked
during migration, so no pre-ACL replica inserts configs after the
migration commits. The API sets the Everyone read grant explicitly on
every insert.

… roles

Delete-authorized callers without update or audit grants could not see
or fetch disabled configs: the list filtered them out and the detail
endpoint concealed them with 404, so a delete-only custom role could
never remove a disabled server. Keep disabled configs in the redacted
list and detail responses when the caller may delete them.

…ure doc

httpapi.Is404Error already returns true for dbauthz.IsNotAuthorizedError,
so the Forbidden branch after it could never execute. Concealing
authorization failures as 404 is the documented intent here, matching
the update and delete handlers.

The ACL authorization behavior does not change the chatd architecture,
so the architecture doc sections flagged for it are not needed.

Reverts a0aca79 and 91b3015.