feat(mcp): [DO-NOT-MERGE-POC] add CMA plugin surface — /mcp/da (18 tools) + /mcp/eds

[anfibiacreativa]

Title

feat(mcp): add CMA plugin surface — /mcp/da (18 tools) + /mcp/eds (4 tools)

Summary

Adds the plugin surface that Claude Managed Agents (CMA) will register as remote MCP servers:
two dependency-free JSON-RPC-over-HTTP endpoints — POST /mcp/da (18 tools) and POST /mcp/eds
(4 tools). This closes the 5-of-18 tool gap so the plugin exposes exactly what the Skills Editor
advertises. It is the code deliverable for SITES-47970 (CMA Migration Phase 1). CMA-first:
branched off main with no AO code carried along.

Problem / root cause

/mcp/da previously exposed only 5 of the 18 tools the Skills Editor's da-tools bundle
advertises (content_list/read/create/update/delete). The other 13 existed only as native
Cloudflare-Worker tool bindings in the chat loop — there is no such worker under CMA, so an
authored agent that relied on them would silently lose functionality. The eds-preview bundle's
4 tools were likewise unavailable as an MCP endpoint.

What changed

• src/mcp-server/handler.ts — dependency-free JSON-RPC MCP transport (initialize,
  tools/list, tools/call, ping) with safe error serialization (exposes message + status
  only; omits backend details).
• src/mcp-server/da-registry.ts — full da-tools bundle (18 tools). The 13 added tools
  (content_copy/move, content_version_create/list, content_media/fragment,
  content_upload, da_get_skill/create_skill, da_list_agents/create_agent,
  da_embed_fragment, write_project_memory) reuse the existing DAAdminClient methods and the
  skills/agents/memory loaders — wiring, not new business logic.
• src/mcp-server/eds-registry.ts — eds-preview bundle (4 preview/publish tools).
• src/server.ts — wire /mcp/da and /mcp/eds routes with Authorization: Bearer
  pass-through (401 on missing token; 503 if the DAADMIN binding is absent).
• da_embed_fragment — advertised in the catalog but never implemented; built fresh here,
  approval-gated, with path sanitization to prevent HTML-attribute injection.
• da_get_skill — registered under the Skills-Editor-advertised name (native chat tool was
  da_read_skill).
• Destructive tools carry a [REQUIRES_APPROVAL] description prefix; CMA's native always_ask
  gate is what enforces the pause.

How to test

1. cd into the branch checkout, npm ci, then npm run dev (serves on http://localhost:4002).
2. List DA tools — expect 18:
   curl -s -X POST http://localhost:4002/mcp/da
   -H "Authorization: Bearer test-token" -H "Content-Type: application/json"
   -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq '.result.tools | length'
3. List EDS tools — expect 4: same call against /mcp/eds.
4. Auth guard — expect HTTP 401 with no Authorization header.
5. Unknown tool — tools/call with a bogus name returns JSON-RPC error -32602.
6. npm test — expect the existing suite green (296 tests).

Risk / follow-ups

• Scope boundary: this PR is the tool surface + MCP protocol, verified at the tools/list /
  dispatch level. End-to-end execution against real content (exp-workspace/frescopa) is NOT
  included — it needs the live stack running plus a valid IMS token (Phase 1 finish-out).
• Pre-existing, not introduced here: tsc reports one error at src/server.ts:348 (sessionId
  possibly undefined in the telemetry block) that already exists on main.
• Publishing /mcp/da at a stable public HTTPS URL + a CMA Vault static-bearer credential is a
  provisioning step (Phase 2), not part of this PR.