feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -60,6 +60,9 @@ type Config struct {
 	// RetentionAllowNever: RETENTION_ALLOW_NEVER=true/false fixes whether people may keep finished and
 	// deleted things for good; unset (nil) leaves it to the system settings
 	RetentionAllowNever *bool
+	// MCPEnabled: MCP_ENABLED=true/false fixes whether the MCP endpoint (and OAuth for connectors) is on;
+	// unset (nil) leaves it to the system settings
+	MCPEnabled *bool
 	// Speech recognition, configured only by environment (STT_*)
 	Speech SpeechConfig
 
@@ -261,6 +264,7 @@ func Load() *Config {
 		DemoResetMinutes:        demoResetMinutes(),
 		TrustedProxies:          getEnv("TRUSTED_PROXIES", "private"),
 		RetentionAllowNever:     envBoolPtr("RETENTION_ALLOW_NEVER"),
+		MCPEnabled:              envBoolPtr("MCP_ENABLED"),
 		DisableLoginProtection:  strings.ToLower(getEnv("LOGIN_PROTECTION", "true")) == "false",
 		OAuthIdleDays:           envInt("OAUTH_IDLE_DAYS", 90, 0, 36500),
 		SMTPHost:                smtpHost,