feat(mcp): add persistent client channels

[FRFlo]

Summary

• Add authenticated persistent MCP client channels for Cloud and self-hosted hosts.
• Bind client capability manifests to MCP sessions and route tools, resources, and prompts to the owning client.
• Add bridge/session isolation coverage, Cloud two-client e2e coverage, and protocol documentation.

Verification

• Scoped oxlint: 433 files, zero warnings/errors.
• Typechecks: host-mcp, cloud, host-selfhost, cloudflare, and core API passed.
• Focused tests: 72 MCP bridge/tool-server tests and 19 Cloud channel/auth tests passed.
• Cloud client-channel e2e passed once; a later rerun was blocked during setup by Windows EPERM while removing e2e/runs/.motel.
• Focused oxfmt check passed.

[FRFlo]

Related client integration: pi-executor#2 implements the client-channel protocol and pi-mcp-adapter#857 supplies the session-scoped bridge for its configured MCP servers. The pi-executor PR depends on both this Executor feature and the adapter bridge.