feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_admin.go

@@ -345,6 +345,11 @@ func (s *Server) settingsForBrowser(settings *domain.SystemSettings) *domain.Sys
 		out.RetentionAllowNever = &allow
 		out.RetentionNeverViaEnv = true
 	}
+	if s.cfg.MCPEnabled != nil {
+		on := *s.cfg.MCPEnabled
+		out.MCPEnabled = &on
+		out.MCPViaEnv = true
+	}
 	out.EmailLinksAvailable = s.emailLinksAvailable()
 	return &out
 }
@@ -381,6 +386,10 @@ func (s *Server) handleAdminUpdateSettings(w http.ResponseWriter, r *http.Reques
 		settings.RetentionAllowNever = nil // fixed by RETENTION_ALLOW_NEVER, the stored value stays
 	}
 	settings.RetentionNeverViaEnv = false
+	if s.cfg.MCPEnabled != nil {
+		settings.MCPEnabled = nil // fixed by MCP_ENABLED, the stored value stays
+	}
+	settings.MCPViaEnv = false
 	previousMode := s.store.SharingMode()
 	if err := s.store.UpdateSystemSettings(&settings); err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())