feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server.go

@@ -536,6 +536,11 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 		} else {
 			token = r.Header.Get("X-API-Key")
 		}
+		// MCP switched off: the endpoint answers as if it did not exist, with or without login
+		if r.URL.Path == mcpPath && !s.mcpEnabled() {
+			writeError(w, http.StatusNotFound, "MCP ist auf diesem Server ausgeschaltet")
+			return
+		}
 		user, key := s.authenticateToken(token)
 		if user == nil {
 			// Tells MCP clients where to start the OAuth flow (RFC 9728)