MCP-Client fuer HTTP-Server: externe Werkzeuge durch dieselben Pruefstellen (#197)

- Core/Mcp/McpClient: Streamable HTTP (MCP 2025-06-18) - initialize, tools/list
  with paging, tools/call; answers as JSON or event stream; session kept and
  opened again when the server forgets it; answers capped at 4 MB.
- McpServerTool: one server is one tool (mcp_<id>); its remote tools are the
  operations, so rights, preflight, staging, lead approvals, votes, audit and
  budget apply. On approval by default unless the human trusts an operation;
  reads foreign content; the server's descriptions are cut short and marked.
- McpConnections: registers, refreshes every 15 minutes, follows changes.
- InstanceConfig.mcpServers with protected headers; /api/mcp-servers;
  settings card "External MCP servers"; tool catalog includes the servers.
- stdio servers are not part of this (sandbox runner, separate step).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ClawdDotNet.Core/Security/ConfigSecrets.cs

@@ -64,6 +64,12 @@ public static class ConfigSecrets
         foreach (var agent in config.Agents)
             Apply(agent, transform);
 
+        // #197: an MCP server's headers carry its token — every value is a secret.
+        foreach (var server in config.McpServers)
+            foreach (var key in server.Headers.Keys.ToList())
+                if (server.Headers[key] is { Length: > 0 } header)
+                    server.Headers[key] = transform(header) ?? "";
+
         // #692: everything a unit holds for its members is a secret, whatever its name.
         foreach (var unit in config.Units)
             foreach (var settings in unit.Credentials?.Values ?? Enumerable.Empty<Dictionary<string, string>>())