Declared reads, OAuth only

POST /api/v1/reads/{id} answers nine declared reads — what is owed, what was collected, the agenda, the funnel, the month — never raw tables and never text someone wrote. Only with an OAuth token, on behalf of a person and with their role (an API key gets reads_need_a_person); each read has its own workspace switch, off by default. The MCP server lists them as read-only tools.