M41: harden trust boundaries and delivery

backend/app/api/deps.py

@@ -67,7 +67,7 @@ def require_operations_manager(
 
 @dataclass(frozen=True)
 class McpClientContext:
-    client_id: str
+    reported_client_id: str
     tenant: str
 
 
@@ -91,4 +91,4 @@ def require_mcp_service_token(
         )
     if x_tenant_id is not None and x_tenant_id != settings.ragcore_tenant:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Tenant mismatch")
-    return McpClientContext(client_id=x_client_id, tenant=settings.ragcore_tenant)
+    return McpClientContext(reported_client_id=x_client_id, tenant=settings.ragcore_tenant)