Feature: Public-demo MCP on GCP (let anyone interact with tasklog.manudubey.in via Claude)

[manucompiles]

Extend the v2.10 MCP feature to the GCP-hosted public demo so visitors at https://tasklog.manudubey.in can manage the demo via the Claude custom connector.

Why

Today the MCP server runs only on the phone, gated to one GitHub user. The public demo is read-write via the web UI but invisible to Claude. Opening MCP on the demo turns the project into a live, hands-on showcase of "what you can do with a self-hosted task system + MCP."

Scope

• Deploy the mcp/ Node service to the GCP VM alongside the existing .NET API + Next.js frontend. systemd unit (not runit).
• Auth: keep GitHub OAuth, remove the ALLOWED_GH_USERS allow-list (any GitHub user can connect after consent).
• Register a second GitHub OAuth App for the demo (separate callback URL).
• Public hostname: mcp-demo.manudubey.in (flat - same Cloudflare Universal SSL constraint as v2.10).
• Extend scripts/deploy-gcp.ps1 to build + transfer the MCP service.

Prerequisites

• MCP: DCR rate limiting + auth.db lifecycle (purge expired rows, janitor, body size limits) #52 (DCR rate limiting + body size limits) MUST land first - the demo is public surface.
• Probably MCP: auth hardening (case-sensitive allow-list, log redaction, code TTL, resource validation, rejection logs) #51 (auth hardening) and MCP: defense-in-depth (Origin required on /mcp, CRLF strip in WWW-Authenticate, auth identity on context) #53 (defense-in-depth) too.

Out of scope

• Per-visitor sandboxed data. The demo's SQLite resets every 6h; all visitors share it during the window. That's an acceptable demo UX, not a bug.

Notes

Idea raised after shipping #50. Defer until after v2.10 lands.