MCP: workspace settings page, sidebar link, and API/token access hardening

[paulocastellano]

Context

Split out of #204. Independent of Welcome / Billing / Onboarding.

Goal

Give workspaces a first-class MCP settings surface and align API/MCP token access with hasAppAccess so trial activation (no card) can use MCP/API safely.

In scope

• Workspace MCP settings page (Claude / ChatGPT first-class; other clients in accordions)
• Shared MCP client list / connect UX assets (public/images/ai/*)
• Sidebar MCP nav item under workspace (depends on Settings shell from the Sidebar issue being merged, or add both together if Sidebar is not yet in)
• AccessToken helpers: list connected MCP clients, revoke MCP OAuth grants, revoke workspace API keys
• Align API/MCP middleware with hasAppAccess (not only subscribed())
• Restrict REST API to personal access tokens where intended; harden self-hosted / token lifecycle
• MCP i18n (lang/*/mcp.php) + settings tab wiring

Out of scope

• Post-subscription onboarding checklist / residual banner
• Welcome funnel
• Billing trial / purchase tracking

Independence

Safe to merge to main alone. Does not require Welcome or Onboarding. Prefer Sidebar issue merged first so the nav item lands in the new shell; if not, still ship the page + hardening and add the nav link in this PR against current sidebar.

Suggested test plan

• MCP settings page loads behind SaaS gate / correct permissions
• Connect / disconnect / copy config flows for hosted + advanced clients
• API + MCP calls succeed under hasAppAccess trial paths
• REST rejects non-PAT tokens as designed
• Sidebar MCP item active state does not keep Settings highlighted