fix(server): write-field-ignored ignores create ids

[kushals256]

Fixes #670

write-field-ignored fired on ordinary, correct APIs: a create that sent sub_category_id: 0 and got back the new row's id, or a public workspace id echoed as an internal row id. The copy then claimed the write half-applied and the UI had no way to know — a strong factual claim about a bug that did not exist — and one such request poisoned every later assert in the window.

0 / "" / null are sentinels ("server, you decide"). id / *_id are identities the server assigns. A locale that comes back as a different locale still fires. The copy names a different echo rather than a write the UI cannot know about.

A read-shaped POST is unchanged: method alone cannot tell it from a write, and silencing it would also silence a genuinely dropped field.

Test plan

• create-at-root 0 is silent; empty string is silent
• two id spaces on workspace_id are silent; url_workspace_id does not pair with workspace_id
• a non-identity field (locale) that came back different still fires
• copy no longer says half-applied / no way to know
• existing echo-mismatch and contradiction suites stay green

Made with Cursor

[kushals256]

Same coverage-floor flake as #750 / #753 / #755, not this change. This run shrank 48 → 46: hidden-api-500 timed out on MCP initialize for Playwright and DevTools, and broken-form-validation/playwright hung on browser_click. Catch-rate stayed 1.0.

Cherry-picked the one-retry from #750 (the same rule replay-detect already uses for a flaky baseline). A missing tool is still a miss.