Consent to a plugin build in this lane landing in its parent chat

Not on Oauth::MCP_ALLOWLIST -- a remote-MCP bearer gets the ordinary deny-by-default 403. Security fix, restated by role: the consent tap that replaces "the person wrote any message in the lane within 10 minutes" as the evidence Api::V1::AppsController#create's A1 landing checks. Caller must be a non-observer member of:id (human or agent), which must be a private lane (coaching_for_chat_id present) whose own parent is neither another lane nor an open room. Stamps plugin_requested_at on the caller's lane membership; a landing within the next 30 minutes consumes it. Deliberately unmapped in MandateCapabilityMap -- refused entirely under X-Salt-Act-For.