Add a stateless Streamable HTTP endpoint at /mcp that lets external agents
list tasks and findings, create tasks, pause/resume them and add hints.
- Access tokens (api_tokens): scopes (read, task:create, task:control),
optional company restriction, task quotas, expiry, revocation. Only the
SHA-256 is stored; the plaintext is returned once.
- /mcp authenticates with access tokens only. It sits outside the HTTP Basic
Auth gate and rejects Basic credentials and the admin JWT.
- Whitelisted tools only; nothing that edits tools, skills, MCP servers,
workspace files or settings is exposed.
- Every tools/call is audited (mcp_audit_log), refusals included.
- POST /api/tasks and the MCP spawn_task tool now share one creation path.
- Settings card for the switch, token management and the call audit.
- Off by default.
Refs RuoJi6/ARTEX#144
