feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/settings/AdminSettingsView.tsx

@@ -160,6 +160,8 @@ export const AdminSettingsView: React.FC<AdminSettingsViewProps> = ({
           backupRetentionDays: sys.backupRetentionDays || 3,
           retentionAllowNever: sys.retentionAllowNever ?? true,
           retentionNeverViaEnv: Boolean(sys.retentionNeverViaEnv),
+          mcpEnabled: sys.mcpEnabled ?? true,
+          mcpConfiguredViaEnv: Boolean(sys.mcpConfiguredViaEnv),
         });
       }
     } catch (err: any) {
@@ -1334,6 +1336,24 @@ export const AdminSettingsView: React.FC<AdminSettingsViewProps> = ({
                     />
                   </div>
 
+                  {/* AI agents over MCP (and claude.ai / ChatGPT over OAuth) */}
+                  <div className="p-4 bg-canvas border border-border rounded-card flex items-center justify-between gap-4">
+                    <div className="pr-4">
+                      <p className="font-bold text-main">KI-Agenten (MCP) erlauben</p>
+                      <p className="text-[11px] text-muted mt-0.5">
+                        Eingeschaltet können Claude Code, Codex & Co. per API-Schlüssel und claude.ai oder ChatGPT als Connector
+                        auf MindSift zugreifen. Ausgeschaltet ist der MCP-Endpunkt samt Connector-Anmeldung abgeschaltet;
+                        bestehende Connector-Verbindungen ruhen, API-Schlüssel funktionieren per curl weiter.
+                        {settings.mcpConfiguredViaEnv && ' Festgelegt per MCP_ENABLED.'}
+                      </p>
+                    </div>
+                    <ToggleSwitch
+                      checked={settings.mcpEnabled !== false}
+                      disabled={Boolean(settings.mcpConfiguredViaEnv)}
+                      onChange={(mcpEnabled) => handleSaveSystemSettings({ mcpEnabled })}
+                    />
+                  </div>
+
                   {/* Who may register without an invite */}
                   {(() => {
                     const mode = settings.registrationMode || 'closed';