Build out: /start + /first-job self-serve loop

[ceedot-rock]

Self-serve product loop from issue/PR #10.

Added

• POST /api/start — register + attempt L1 issue
• /start — name → identity card (api_key once, honest store/db_error)
• /first-job — list/claim/submit via existing task APIs + X-Agent-Rider
• docs/BUILD_OUT_2026-09-09.md

Does not close #11. GRANT + fly deploy still required for durable ledger.
Do not mint keys against the pre-deploy Fly box.

[ceedot-rock]

MCP follow-up (Benjamin)

This PR ships the human start loop. Live MCP still has 63 tools and no issue_rider / verify_rider. Register exists; every write tool still says “obtain a rider via POST /api/rider/issue”.

Add src/lib/mcp-identity-tools.ts + one call next to registerCddgTools(server, …):

import { registerIdentityMcpTools } from “@/lib/mcp-identity-tools”;
registerIdentityMcpTools(server, { textResult, errorResult });

issue_rider takes api_key from register, caps at L1, returns { rider, jti, expires_in, header_to_send }.
verify_rider wraps verifyRider().

Also still open vs lock:

• GET /api/agents list (supabase + disk)
• README host lock: Fly official, Vercel 402

Do not merge as “live identity fixed”. GRANT + fly deploy still required.