fix: four CLI and MCP bugs (#91, #74, #87, #73)

[jlrickert]

Four independent fixes, one commit each.

Integer frontmatter fields were unwritable (#91)

valueToYAMLNode tagged every integer and float !!str, so a schema field typed integer could not be satisfied through the MCP create or edit tools. A schema marking such a field required was impossible to satisfy at all: the node could not be created, and meta could not repair it afterwards because it validates the whole node including markdown sections.

Integers now tag !!int and floats !!float, matching the !!bool case that was already correct. Integral floats serialize as plain integers, because JSON has no integer type and a value sent over MCP as 1 arrives as float64(1) while still needing to satisfy a type: integer check.

The create tool's attrs parameter is widened to map[string]any. A string-typed Go map generated additionalProperties: {type: string}, which cannot express a number by construction. The CLI --attrs flag keeps its string map, since its values genuinely arrive as text.

Nested map keys are now sorted, so repeated writes of the same value produce byte-identical YAML.

Unqualified flight create used the wrong namespace (#74)

tap flight create NAME resolved its namespace from defaultNamespace, the user's personal namespace. Working in an org KEG and typing a bare flight name created the flight under the personal namespace instead. Nothing failed loudly: the flight was valid, simply absent from the org's flights page, and able to collide with a later explicitly qualified one.

The active KEG's namespace now comes first in the precedence chain. The selector chain matches resolveIdentity and resolveKegAdminRef, so flight creation agrees with what tap info reports as active. Only a namespace the KEG selector states explicitly counts, so a bare keg name still falls through rather than being resolved into the personal namespace and presented as if the KEG had named it.

Auth failures gave no actionable guidance (#87)

An auth failure fell through to bare error text with no structured content, so an agent whose session lost access had no indication that reorienting is the refresh boundary.

Wording alone would have been false advice. The credential store is loaded once per process, so a token written by tap auth login in a separate shell was invisible to a running MCP server and no amount of reorienting could clear the 401. Orientation already reloads configuration; credentials now reload on the same boundary, including the resolved keg cache whose entries captured the previous resolver.

Auth errors return structured content with a code, an action, and reorientRequired. A 403 is kept distinct: the credential was accepted and the caller simply lacks the grant, so logging in again changes nothing and reorientRequired stays false rather than starting a loop that cannot succeed. Neither message carries token or credential detail.

Namespace list covered only one hub (#73)

tap namespace list queried only the selected hub, hiding memberships on every other configured hub, and its output carried no hub column so rows were unattributable.

With no --hub, every configured remote and readonly hub is queried and each row names its source hub, so the same namespace name on two hubs stays two distinct rows. An unreachable hub becomes a warning naming that hub while the remaining hubs still list, mirroring how HubListKegs already handles aggregate mode. An explicit --hub keeps its previous behavior and still propagates that hub's error.

Partial. The issue also asks for local namespaces. Tapper has no local hub kind: config admits only remote and readonly, and every resolver rejects anything else. Representing locally-backed namespaces needs that kind to exist first, so this is left open.

Follow-up worth filing separately

Flight references resolve three different ways. Read operations search every configured hub for a unique slug match, write operations use the single-namespace default fixed here, and MCP graph selection resolves against the pinned flight root. Unifying them is a larger change than this PR should carry.

Verification

go build ./... and go test ./... pass. New coverage: numeric and nested-map metadata round-tripping, the flight namespace precedence table, the auth error payload including the no-credential-leak criterion, credential reload after a login written by another process, and namespace aggregation across two hubs including the unreachable-hub case.

Manual end-to-end checks against a running hub are still outstanding.