Function build_auth_layer 

pub fn build_auth_layer(
    policy: &AuthPolicy,
    static_token: Option<Arc<str>>,
    resource_url: Option<Arc<str>>,
    static_token_write: bool,
) -> Option<AuthLayer>

Build a [soma_auth::AuthLayer] from an AuthPolicy, or None when the trust boundary is outside the mounted HTTP auth layer.

The static bearer token is read-only (soma:read) unless static_token_write (SOMA_MCP_STATIC_TOKEN_WRITE) grants soma:write. Both bearer-only and OAuth-hybrid deployments flow through this single call site, so the static-token scope grant can never drift between the two modes (the parity bug cortex fixed separately in each of its paths).