feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/mcp.go

@@ -190,6 +190,14 @@ func (s *Server) handleMCP(w http.ResponseWriter, r *http.Request) {
 
 // handleMCPNoStream: the endpoint is stateless and has no server-initiated stream (GET) or session to
 // end (DELETE).
+// mcpEnabled: MCP_ENABLED if set, else the admin's switch in the system settings (default: on).
+func (s *Server) mcpEnabled() bool {
+	if s.cfg.MCPEnabled != nil {
+		return *s.cfg.MCPEnabled
+	}
+	return s.store.MCPEnabledSetting()
+}
+
 func handleMCPNoStream(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Allow", "POST")
 	writeError(w, http.StatusMethodNotAllowed, "Der MCP-Endpunkt nimmt nur POST an (kein Server-Stream)")