Let an AI agent see the open editor through MCP (#429)

Claude Code should be able to work inside the user's open editor tab.
This first stage connects the two and lets the agent look: what the
user sees and a picture of it. Changing the project comes in stage 2.

- An agent token per account opens only /mcp, no API route. The
  dialog "Agent tokens..." in the account menu creates it once, shows
  the ready "claude mcp add" line and revokes it. The server keeps
  only its sha256 (api/lib/AgentTokens.php).
- Wrong tokens count into the sign-in brake from #427. Changing the
  password, renaming or deleting an account ends its tokens.
- The relay (tools/mcp/) is a small Node service without packages,
  WebSocket server included. It runs in the container feuerwerk-mcp
  because PHP-FPM cannot hold connections. Whether a token or a tab
  ticket is valid is still decided by the PHP API, through two routes
  that answer only with the relay key.
- The tab joins over WebSocket on the same origin with the normal
  session, an Origin check and a one-time ticket. It connects only
  after "Agent" is switched on in the account menu. One tab per
  account is active, a new one takes over. Guests get nothing.
- Tools: get_view (project, tab, document, selection with names,
  camera, play state, open dialog) and screenshot. The resource
  feuerwerk://view can be subscribed. Claude Code does not act on
  that reliably, so a changed view is also noted on the next answer.
- A badge next to the account menu shows the connected agents. It
  counts only agents with an open stream or a request in the last
  two minutes.
- CI starts the relay in front of php -S (tools/ci/serve.sh), and
  e2e 71 runs the whole path in the browser.

Found on the live test: the badge showed four agents because old
sessions of revoked tokens were still counted.

Tests:
- Gate on atx: 316 files, 4888 tests
- relay protocol test with fake API and fake tabs: 23/23
- get_view, tools, socketUrl: 16/16
- PHP agents 29, rights 103 checks
- e2e 71 on atx 10/10, against the live site 10/10, no CSP violation
- real Claude Code against the live site: get_view answered
- ZAP against /mcp: nothing at High or Medium
- every new check fails when the guard it covers is taken out (6)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/site.test.ts

@@ -1,5 +1,12 @@
 import { describe, expect, it } from 'vitest';
-import { API_ENDPOINT, dataPath, moveOldStoredKeys, sitePath } from '../../src/core/site';
+import {
+  API_ENDPOINT,
+  dataPath,
+  MCP_PATH,
+  moveOldStoredKeys,
+  sitePath,
+  socketUrl,
+} from '../../src/core/site';
 
 function memoryStore(initial: Record<string, string>) {
   const items = new Map(Object.entries(initial));
@@ -21,6 +28,16 @@ describe('site', () => {
     expect(dataPath('textures')).toBe('/feuerwerk/data/textures');
   });
 
+  it('opens the MCP relay on the page’s own host, encrypted on an encrypted page (#429)', () => {
+    expect(MCP_PATH).toBe('/feuerwerk/mcp');
+    expect(socketUrl('/mcp', { protocol: 'https:', host: 'feuerwerk.nockal.com' })).toBe(
+      'wss://feuerwerk.nockal.com/mcp',
+    );
+    expect(socketUrl('/feuerwerk/mcp', { protocol: 'http:', host: '127.0.0.1:8081' })).toBe(
+      'ws://127.0.0.1:8081/feuerwerk/mcp',
+    );
+  });
+
   it('takes the path from the folder of the open page', () => {
     expect(sitePath('/feuerwerk/')).toBe('/feuerwerk/');
     expect(sitePath('/feuerwerk/index.html')).toBe('/feuerwerk/');