feat(mcp): operators can switch MCP (and OAuth) off

Admin switch in the system settings, MCP_ENABLED fixes it. Off: the
endpoint answers 404, OAuth is off, the API key settings hide the MCP tab.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/system.go

@@ -179,6 +179,9 @@ func (s *Store) GetSystemSettings() (*domain.SystemSettings, error) {
 			case "retention_allow_never":
 				allow := v != "false"
 				settings.RetentionAllowNever = &allow
+			case "mcp_enabled":
+				on := v != "false"
+				settings.MCPEnabled = &on
 			}
 		}
 	}
@@ -194,6 +197,10 @@ func (s *Store) GetSystemSettings() (*domain.SystemSettings, error) {
 		allow := true
 		settings.RetentionAllowNever = &allow
 	}
+	if settings.MCPEnabled == nil {
+		on := true
+		settings.MCPEnabled = &on
+	}
 	return settings, nil
 }
 
@@ -280,5 +287,16 @@ func (s *Store) UpdateSystemSettings(settings *domain.SystemSettings) error {
 		_, err = s.db.Exec(`INSERT INTO system_settings (key, value) VALUES ('retention_allow_never', ?)
 			ON CONFLICT(key) DO UPDATE SET value = excluded.value`, strconv.FormatBool(*settings.RetentionAllowNever))
 	}
+	if err == nil && settings.MCPEnabled != nil {
+		_, err = s.db.Exec(`INSERT INTO system_settings (key, value) VALUES ('mcp_enabled', ?)
+			ON CONFLICT(key) DO UPDATE SET value = excluded.value`, strconv.FormatBool(*settings.MCPEnabled))
+	}
 	return err
 }
+
+// MCPEnabledSetting: the admin's switch for the MCP endpoint in the system settings (default: on).
+func (s *Store) MCPEnabledSetting() bool {
+	var v string
+	_ = s.db.QueryRow(`SELECT value FROM system_settings WHERE key = 'mcp_enabled'`).Scan(&v)
+	return v != "false"
+}