v3 MCP page: implement install/uninstall/config (ADR-0013 mcp_client.py)

[thinmintdev]

PR #304 closed #206 by wiring the v3 dashboard MCP page to read-only /api/mcp/* introspection routes. The lifecycle mutations were intentionally stubbed with 501 mcp.not_implemented:

• POST /api/mcp/install
• DELETE /api/mcp/{id}
• POST /api/mcp/{id}/{action} (start / stop / restart)
• PATCH /api/mcp/{id}/config

This issue tracks landing the real implementations as part of ADR-0013's mcp_client.py allow-list work. Acceptance:

• POST /api/mcp/install spawns the supervisor entry, writes config, returns {id, state: "installing"} and emits SSE progress frames
• DELETE /api/mcp/{id} removes the supervisor + config + binary cache
• POST /api/mcp/{id}/{restart|start|stop} drives the supervisor
• PATCH /api/mcp/{id}/config merges env + auto-start fields and triggers a restart
• Hook layer (ui/src/api/hooks/useMcp.ts) keeps the existing surface; remove the 501-catch + toast paths once the routes go live
• Replace static _CATALOG in src/hal0/api/routes/mcp.py with a real registry probe

Reference:

• ADR-0013 — per-agent MCP client allow-list
• PR feat(api+dash): wire MCP page to real backend (closes #206) #304 — read-only wiring + 501 stubs
• Issue v3: wire MCP page (/agents/mcp) to real backend #206 — original feature request