feat(mcp): Streamable HTTP MCP server on the capability registry

POST/GET/DELETE /api/v1/mcp with API Key auth; tools are the capabilities
visible to the key's scope (download__submit naming), every call goes through
registry.invoke (authorize, audit, idempotency key, ledger) with source=mcp.
Resources: settings summary, pending decisions, subscriptions overview;
prompts: triage_pending, acquire_title, diagnose_task. Sessions bound to the
API key, idle reaping, per-key rate limits, enable switch and key allowlist.
Also GET /capabilities/stats (from audit_event) and /capabilities/tools.
Tests connect with the official SDK client over Streamable HTTP.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/index.ts

@@ -3,6 +3,7 @@ import { agentModule } from "./agent/index.ts";
 import { authSettingsModule } from "./auth-settings/index.ts";
 import { browserModule } from "./browser/index.ts";
 import { fileManagerModule } from "./file-manager/index.ts";
+import { mcpModule } from "./mcp/index.ts";
 import { piModule } from "./pi/index.ts";
 import { schedulesModule } from "./schedules/index.ts";
 import { searchModule } from "./search/index.ts";
@@ -26,5 +27,6 @@ export const SERVER_MODULES: readonly ServerModule[] = [
   schedulesModule,
   searchModule,
   browserModule,
+  mcpModule,
   systemModule,
 ];