feat(mcp): Streamable HTTP MCP server on the capability registry

POST/GET/DELETE /api/v1/mcp with API Key auth; tools are the capabilities
visible to the key's scope (download__submit naming), every call goes through
registry.invoke (authorize, audit, idempotency key, ledger) with source=mcp.
Resources: settings summary, pending decisions, subscriptions overview;
prompts: triage_pending, acquire_title, diagnose_task. Sessions bound to the
API key, idle reaping, per-key rate limits, enable switch and key allowlist.
Also GET /capabilities/stats (from audit_event) and /capabilities/tools.
Tests connect with the official SDK client over Streamable HTTP.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/mcp/index.ts

@@ -0,0 +1,31 @@
+import denoJson from "../../../deno.json" with { type: "json" };
+import type { ServerModule } from "../types.ts";
+import { createMcpConfigStore } from "./config-store.ts";
+import { registerMcpRoutes } from "./routes.ts";
+import { McpSessionTable } from "./sessions.ts";
+
+/**
+ * AG-1 对外 MCP 服务端(REQ R13、§12.3):/mcp 走 Streamable HTTP,API Key 鉴权,
+ * 每个工具对应一个能力,调用走同一个 registry.invoke(不绕过授权);另提供能力统计、能力清单与 MCP 状态/配置。
+ * 会话表在进程内(api / all 角色),停机时全部关闭。
+ */
+export function createMcpModule(opts: { version?: string } = {}): ServerModule & { sessions: McpSessionTable } {
+  const table = new McpSessionTable();
+  return {
+    name: "mcp",
+    sessions: table,
+    registerRoutes(app, ctx) {
+      registerMcpRoutes(app, ctx, {
+        table,
+        config: createMcpConfigStore(() => ctx.db),
+        version: opts.version ?? denoJson.version,
+      });
+    },
+    registerTasks() {},
+    async stop() {
+      await table.closeAll();
+    },
+  };
+}
+
+export const mcpModule = createMcpModule();