feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/types.ts

@@ -17,6 +17,8 @@ export interface AuthStatus {
   sharingMode?: SharingMode;
   // "Passwort vergessen?" works (SMTP and BASE_URL configured)
   passwordReset?: boolean;
+  // AI agents may connect over MCP (the operator can switch it off)
+  mcpEnabled?: boolean;
   // MCP address for claude.ai / ChatGPT connectors (OAuth); empty when the server has no BASE_URL
   mcpConnectorUrl?: string;
   // Demo mode with periodic reset: next reset (ISO) and seconds until then
@@ -301,6 +303,9 @@ export interface SystemSettings {
   // People may keep finished and deleted things for good ("nie"); fixed when set via RETENTION_ALLOW_NEVER
   retentionAllowNever?: boolean;
   retentionNeverViaEnv?: boolean;
+  // AI agents may connect over MCP (and claude.ai / ChatGPT over OAuth); fixed when set via MCP_ENABLED
+  mcpEnabled?: boolean;
+  mcpConfiguredViaEnv?: boolean;
 }
 
 /** One file of a server backup listing. */