feat(mcp): MCP server for AI agents, agent scopes on API keys, switches in settings

MindSift now speaks MCP (Streamable HTTP, stateless JSON-RPC) at POST /api/v1/mcp so
Claude Code, Codex, Claude Desktop, Cursor and custom agents can read, create and
complete tasks and keep shared lists. API keys get the scopes tasks:read/write and
lists:read/write; tools/list only shows what the key may call and every tool checks
its scope. Task and list write paths are shared helpers (updateTask, createTask,
addListItem, setListItemDone) used by REST and MCP alike.

Settings: scope selection and the SectionPicker (import, restore) use ToggleSwitch
rows instead of checkbox-like buttons; new MCP section with connection snippets for
Claude Code, Codex and JSON configs. Docs, README, help and changelog updated; v0.28.0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

frontend/src/features/settings/__tests__/ApiKeysPanel.test.tsx

@@ -24,18 +24,27 @@ describe('ApiKeysPanel', () => {
   it('shows the scopes of existing keys as badges', async () => {
     render(<ApiKeysPanel />);
     expect(await screen.findByText('Rauchmelder')).toBeTruthy();
-    expect(screen.getAllByText('📋 Aufgaben').length).toBeGreaterThan(1); // chip + badge
+    expect(screen.getAllByText('📋 Aufgaben anlegen').length).toBeGreaterThan(1); // switch label + badge
   });
 
   it('creates a key with the chosen scopes and never without one', async () => {
     render(<ApiKeysPanel />);
-    const triage = screen.getByRole('checkbox', { name: /Triage/ });
+    const triage = screen.getByRole('switch', { name: /Triage/ });
     fireEvent.click(triage); // last remaining scope cannot be switched off
     expect(triage.getAttribute('aria-checked')).toBe('true');
-    fireEvent.click(screen.getByRole('checkbox', { name: /Listeneinträge/ }));
+    fireEvent.click(screen.getByRole('switch', { name: /Listeneinträge anlegen/ }));
     await act(async () => {
       fireEvent.click(screen.getByRole('button', { name: /API-Key erzeugen/ }));
     });
     expect(createAPIKey).toHaveBeenCalledWith('Home Assistant', ['webhook:triage', 'webhook:list']);
   });
+
+  it('offers agent scopes and shows how to connect an MCP client', async () => {
+    render(<ApiKeysPanel />);
+    fireEvent.click(screen.getByRole('switch', { name: /Aufgaben ändern/ }));
+    expect(screen.getByRole('switch', { name: /Aufgaben ändern/ }).getAttribute('aria-checked')).toBe('true');
+    expect(screen.getByText(/claude mcp add --transport http mindsift/)).toBeTruthy();
+    fireEvent.click(screen.getByRole('radio', { name: 'OpenAI Codex' }));
+    expect(screen.getByText(/\[mcp_servers\.mindsift\]/)).toBeTruthy();
+  });
 });

frontend/src/features/settings/__tests__/SectionPicker.test.tsx

@@ -0,0 +1,16 @@
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen, fireEvent } from '@testing-library/react';
+import { SectionPicker } from '../SectionPicker';
+
+describe('SectionPicker', () => {
+  it('uses switches and keeps at least one section on', () => {
+    const onChange = vi.fn();
+    render(<SectionPicker value={['notes']} onChange={onChange} />);
+    const notes = screen.getByRole('switch', { name: 'Notizen' });
+    expect(notes.getAttribute('aria-checked')).toBe('true');
+    fireEvent.click(notes); // last one cannot be switched off
+    expect(onChange).not.toHaveBeenCalled();
+    fireEvent.click(screen.getByRole('switch', { name: 'Listen' }));
+    expect(onChange).toHaveBeenCalledWith(['notes', 'lists']);
+  });
+});