feat(mcp): connect card, MCP docs, and an end-to-end roles/audit test over HTTP

MCP-8 #4972 "Connect card, docs, and end-to-end integration test".

- AI access page: a "Connect a client" card with the /mcp URL (from
  Settings → General → Public base URL, else the request host) and recipes
  for Claude Code, Claude Desktop (mcp-remote) and other Streamable HTTP
  clients, plus the reverse-proxy note. The token-created page shows the
  same recipes with the new token filled in, ready to paste.
- docs/core/mcp.md: connecting, the reverse-proxy requirements, the
  security model (token ceiling, default deny, check-mode default, secrets,
  audit), tools by role, response conventions, adding tools.
  docs/architecture.md describes the /mcp dispatch outside the blueprint
  pipeline; docs/reference/code-map.md gains an MCP section.
- tests/integration/test_mcp.py: over HTTP, a viewer token lists no write
  tools and is refused one by name; an operator token reads get_overview
  and its maintenance-window create/end land in the audit log as
  "<user> via MCP" with the token id. (Revoked → 401 was already covered.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/ai_access/routes.py

@@ -14,6 +14,8 @@ from sqlalchemy import select
 from steward.auth.middleware import current_user_id, require_role
 from steward.core import api_tokens
 from steward.core.audit import log_audit
+from steward.core.settings import public_base_url
+from steward.mcp.server import MCP_PATH
 from steward.models.users import User, UserRole
 
 ai_access_bp = Blueprint("ai_access", __name__, url_prefix="/ai-access")
@@ -21,6 +23,11 @@ ai_access_bp = Blueprint("ai_access", __name__, url_prefix="/ai-access")
 _EXPIRY_CHOICES = [("", "Never"), ("30", "30 days"), ("90", "90 days"), ("365", "1 year")]
 
 
+def _mcp_url() -> str:
+    """The /mcp endpoint as a client outside this request reaches it."""
+    return public_base_url(request) + MCP_PATH
+
+
 async def _session_user(db) -> User:
     user_id = current_user_id()
     if not user_id:
@@ -42,6 +49,7 @@ async def _render_index(db, user: User, *, error: str | None = None, status: int
         grantable=api_tokens.grantable_roles(user.role),
         expiry_choices=_EXPIRY_CHOICES,
         error=error,
+        mcp_url=_mcp_url(),
     )
     return body, status
 
@@ -81,7 +89,8 @@ async def create():
     await log_audit(current_app, user.id, user.username, "api_token.create",
                     entity_type="api_token", entity_id=str(token.id),
                     detail={"name": token.name, "role": token.role.value})
-    return await render_template("ai_access/created.html", raw_token=raw, token=token)
+    return await render_template("ai_access/created.html", raw_token=raw, token=token,
+                                 mcp_url=_mcp_url())
 
 
 @ai_access_bp.post("/tokens/<int:token_id>/revoke")