feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_auth.go

@@ -48,6 +48,8 @@ func (s *Server) handleAuthStatus(w http.ResponseWriter, r *http.Request) {
 		"demoMode":            s.cfg.DemoMode,
 		"sharingMode":         s.store.SharingMode(),
 		"passwordReset":       s.passwordResetAvailable(),
+		// AI agents may connect over MCP (MCP_ENABLED or the admin's switch)
+		"mcpEnabled": s.mcpEnabled(),
 		// Address to enter as connector in claude.ai / ChatGPT (OAuth); empty while OAuth is off
 		"mcpConnectorUrl": func() string {
 			if s.oauthEnabled() {