feat(settings): hide the notes rights while MCP is off, mention notes in the API intro

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/settings/ApiKeysPanel.tsx

@@ -103,7 +103,7 @@ export const ApiKeysPanel: React.FC<ApiKeysPanelProps> = ({ onIngested }) => {
   // Switches grouped by tasks, lists, notes and inbox (same layout for a new and an existing key)
   const renderScopeSwitches = (selected: ApiKeyScope[], toggle: (id: ApiKeyScope) => void, label: string) => (
     <div className="grid grid-cols-1 lg:grid-cols-2 gap-3" role="group" aria-label={label}>
-      {SCOPE_GROUPS.map(([group, heading]) => (
+      {SCOPE_GROUPS.filter(([group]) => mcpEnabled || group !== 'notes').map(([group, heading]) => (
         <div key={group} className="border border-border rounded-card bg-panel px-3 py-1.5">
           <p className="text-[11px] text-muted pt-1 pb-0.5 font-semibold">{heading}</p>
           {SCOPES.filter((sc) => sc.group === group).map((sc) => (

frontend/src/features/settings/UserSettingsView.tsx

@@ -1956,7 +1956,8 @@ export const UserSettingsView: React.FC<UserSettingsViewProps> = ({
                 <h2 className="text-sm font-bold text-main">API</h2>
                 <p className="text-muted mt-0.5">
                   Mit persönlichen API-Schlüsseln lesen und ändern Skripte, dein Smart Home oder KI-Agenten wie Claude Code
-                  und Codex deine Aufgaben, Listen und die Inbox: per curl oder über MCP, mit denselben Rechten.
+                  und Codex deine Aufgaben, Listen und die Inbox: per curl oder über MCP, mit denselben Rechten. Notizen
+                  lesen und anlegen geht nur über MCP.
                 </p>
               </div>
 

frontend/src/features/settings/__tests__/ApiKeysPanel.test.tsx

@@ -67,6 +67,7 @@ describe('ApiKeysPanel', () => {
     render(<ApiKeysPanel />);
     await act(async () => {});
     expect(screen.queryByRole('tab', { name: /KI-Agenten/ })).toBeNull();
+    expect(screen.queryByRole('switch', { name: 'Notizen lesen' })).toBeNull();
     expect(screen.getAllByText(/tasks\?due=today&status=open/).length).toBeGreaterThan(0);
   });