feat: MCP Gateway with console UI, quota enforcement, and audit logging

[hammadtq]

Summary

This PR implements an OSS-friendly, local-first MCP (Model Context Protocol) Gateway layer for Attach Gateway. Key features:

• MCP Reverse Proxy (/mcp/{server}) - JWT-protected JSON-RPC proxy to configured MCP servers
• Console UI (/console) - Admin dashboard with public landing page and protected API endpoints
• Per-user Quota Enforcement - Daily tool call limits with glob pattern matching (e.g., github.*: 200)
• SQLite Audit Logging - Local audit trail of all MCP requests in ~/.attach/attach.db
• CLI Commands - attach-gateway mcp add/list/enable/disable and attach-gateway claude install
• OpenMeter Non-fatal Fallback - Missing API key warns instead of crashing

Design Principles

• Opt-in only - MCP features disabled by default, enabled via ATTACH_ENABLE_MCP=true or ~/.attach/mcp.json
• No breaking changes - Existing OIDC sidecar functionality unchanged
• Namespace isolation - All new modules under attach/mcp/, attach/audit/, attach/console/
• Local-first - All data stored locally in SQLite, no phone-home behavior

Files Changed

Area	Description
attach/mcp/	Config, proxy, quota, router modules
attach/audit/	SQLite audit logging
attach/console/	Console UI router and static assets
attach/cli_mcp.py	MCP server management CLI
attach/cli_claude.py	Claude Code integration helper
middleware/auth.py	Auth exclusions for console static assets
usage/factory.py	OpenMeter non-fatal fallback

Test Coverage

• 16 new integration tests covering MCP + auth + quota
• 7 E2E tests with Ollama backend
• All MCP-related tests pass (27/27)

Test plan

• Run pytest tests/ - 55 passed, 5 pre-existing failures unrelated to this PR
• Verify MCP endpoints require JWT authentication
• Verify console landing page is public, API is protected
• Verify per-user quota isolation works correctly
• Verify audit logs capture all MCP requests
• Verify E2E proxy to Ollama works with auth
• Manual testing of CLI commands
• Manual testing of console UI in browser

🤖 Generated with Claude Code