RBAC in MCP: Different Tools for Different Users

Streamable HTTP transport plus per-caller bearer-to-Moodle token mapping: a student and a teacher connect to the same server and are handed different tool lists. The learner's client never even sees create_course.

Follow along in the companion repo, where the phased plan and locked decisions live in CLAUDE.md. This page updates the moment the phase is done.