merge: AgentProject membership — the junction is now load-bearing

Merges feat/agent-project-membership (task 166/152). An agent can finally join
many projects: membership routes, per-membership role and optional brain
override, chat resolving context from the membership, and CLI attach-agent /
detach-agent / get memberships. The legacy Agent.projectId fallback is kept for
this release as the schema comment promises.

Conflict resolved in main.ts: that branch added its RBAC case to
mapUrlToPermission inline, while this branch had extracted the function to
middleware/url-permission.ts so it could be tested. Kept the extraction and
ported the case into it — joining a team is `edit:agents:<name>`, not
`create:agents`, which is the authority to mint a whole agent.

Also fixes something the extraction makes possible. security.test.ts contained a
hand-copied reproduction of mapUrlToPermission, because main.ts self-invokes
main() and nothing in it was importable. A security test asserting against a
copy stops testing the system the moment the real one changes, and this copy had
already drifted. It now imports the real function; all 18 assertions still pass,
against the code that actually runs.

Local: build clean, workspace 2550 passed, lint unchanged at 794 errors.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N4wNHWf7xSwnZCWpJcyv9p

.taskmaster/tasks/task_064.md

@@ -0,0 +1,58 @@
+# Task ID: 64
+
+**Title:** Add unit tests for tag matching algorithm
+
+**Status:** done
+
+**Dependencies:** 45 ✓
+
+**Priority:** high
+
+**Description:** Create comprehensive unit tests for the deterministic tag matching algorithm covering score calculation, byte budget, and priority handling.
+
+**Details:**
+
+1. Add tests in `/src/mcplocal/tests/services/tag-matcher.test.ts`:
+   ```typescript
+   describe('TagMatcherService', () => {
+     describe('score calculation', () => {
+       it('priority 10 prompts have infinite score', () => {
+         const score = matcher.computeScore(['any'], { priority: 10, ... });
+         expect(score).toBe(Infinity);
+       });
+       
+       it('score = matching_tags * priority', () => {
+         const score = matcher.computeScore(
+           ['tag1', 'tag2'],
+           { priority: 5, summary: 'tag1 tag2', chapters: [] }
+         );
+         expect(score).toBe(10); // 2 tags * 5 priority
+       });
+     });
+     
+     describe('matching', () => {
+       it('matches case-insensitively', () => {
+         const matches = matcher.matchesPrompt('ZIGBEE', { summary: 'zigbee setup' });
+         expect(matches).toBe(true);
+       });
+       
+       it('matches substring in summary', () => { ... });
+       it('matches substring in chapters', () => { ... });
+     });
+     
+     describe('byte budget', () => {
+       it('includes full content until budget exhausted', () => { ... });
+       it('matched prompts beyond budget become index entries', () => { ... });
+       it('non-matched prompts listed as names only', () => { ... });
+     });
+   });
+   ```
+
+**Test Strategy:**
+
+This task IS the test implementation. Verify:
+- Score calculation tests pass
+- Matching tests cover all cases
+- Byte budget tests verify allocation
+- Edge cases handled (empty tags, no prompts, etc.)
+- Tests are deterministic