feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/settings/__tests__/ApiKeysPanel.test.tsx

@@ -3,13 +3,16 @@ import { render, screen, fireEvent, act, within } from '@testing-library/react';
 
 const createAPIKey = vi.fn(async () => ({ id: 'k1', userId: 'u', name: 'HA', keyPrefix: 'mindsift_sec_ab', scopes: 'webhook:triage,webhook:list', createdAt: '' }));
 const updateAPIKey = vi.fn(async () => ({}));
+const getAuthStatus = vi.fn(async (): Promise<{ mcpConnectorUrl?: string; mcpEnabled?: boolean }> => ({
+  mcpConnectorUrl: 'https://ms.example/api/v1/mcp',
+}));
 vi.mock('../../../lib/api', () => ({
   api: {
     getAPIKeys: vi.fn(async () => [
       { id: 'k0', userId: 'u', name: 'Rauchmelder', keyPrefix: 'mindsift_sec_xy', scopes: 'webhook:triage,webhook:task', createdAt: '' },
       { id: 'k9', userId: 'u', name: 'Claude (OAuth)', keyPrefix: 'OAuth', scopes: 'tasks:read', createdAt: '', kind: 'oauth' },
     ]),
-    getAuthStatus: vi.fn(async () => ({ mcpConnectorUrl: 'https://ms.example/api/v1/mcp' })),
+    getAuthStatus: (...args: unknown[]) => getAuthStatus(...(args as [])),
     getAllLists: vi.fn(async () => []),
     getTaskLists: vi.fn(async () => []),
     createAPIKey: (...args: unknown[]) => createAPIKey(...(args as [])),
@@ -59,6 +62,14 @@ describe('ApiKeysPanel', () => {
     expect(screen.getByText(/\[mcp_servers\.mindsift\]/)).toBeTruthy();
   });
 
+  it('hides the MCP tab when the operator switched MCP off', async () => {
+    getAuthStatus.mockResolvedValueOnce({ mcpConnectorUrl: '', mcpEnabled: false });
+    render(<ApiKeysPanel />);
+    await act(async () => {});
+    expect(screen.queryByRole('tab', { name: /KI-Agenten/ })).toBeNull();
+    expect(screen.getAllByText(/tasks\?due=today&status=open/).length).toBeGreaterThan(0);
+  });
+
   it('marks OAuth connections instead of showing a key prefix', async () => {
     render(<ApiKeysPanel />);
     expect(await screen.findByText('Claude (OAuth)')).toBeTruthy();