feat(mcp): contracts, capability stats migration and MCP SDK dependency

- contracts/mcp.ts: capability stats/tools, MCP server status/config schemas, mcpToolVisible
- api.ts: GET /capabilities/stats, GET /capabilities/tools, GET /mcp/status, PATCH /mcp/config
- migration 0039: mcp_server_config single row + audit_event capability index
- deno.json: npm:@modelcontextprotocol/[email protected].1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/db/migrations/0039_capability_stats.ts

@@ -0,0 +1,36 @@
+import type { Kysely } from "kysely";
+import { dropTables, execDdl } from "../src/migration-helpers.ts";
+
+// AG-1 对外 MCP 服务端与能力统计:
+// - mcp_server_config:单行配置(启用开关、允许连接的 API Key;null = 所有未撤销的 Key)。
+// - 能力调用统计直接汇总 audit_event(capability.invoke / capability.denied 覆盖读写全部能力,
+//   capability_invocation 只记有副作用的调用);补一条按能力 + 时间的部分索引。
+
+// biome-ignore lint/suspicious/noExplicitAny: 迁移不依赖应用表类型
+export async function up(db: Kysely<any>): Promise<void> {
+  await execDdl(
+    db,
+    `
+create table mcp_server_config (
+  id integer primary key default 1 check (id = 1),
+  enabled boolean not null default true,
+  allowed_api_key_ids text[],
+  updated_by text,
+  updated_at timestamptz not null default now()
+);
+insert into mcp_server_config (id) values (1);
+
+create index if not exists audit_event_capability_idx on audit_event (target_id, at)
+  where target_type = 'capability';
+`,
+  );
+}
+
+// biome-ignore lint/suspicious/noExplicitAny: 同上
+export async function down(db: Kysely<any>): Promise<void> {
+  await execDdl(
+    db,
+    `drop index if exists audit_event_capability_idx;
+${dropTables(["mcp_server_config"])}`,
+  );
+}