feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

service/rpc/wait_for_agent_revoke_test.go

@@ -0,0 +1,56 @@
+package rpc
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// WaitForAgent 必须在 stream 被 RevokeStreamsForPurpose 强制下线时立刻返回，
+// 否则 EnableMCP=false 的 kill switch 不能真的“立即”切断那些还卡在
+// “等待 agent attach” 阶段的 transfer 请求 —— 它们会一直等到 timeout
+// （生产路径上是 30 秒）。
+//
+// 期望行为：调用 RevokeStreamsForPurpose 后，WaitForAgent 在远小于 timeout
+// 的时间内返回 (nil, false)。
+func TestWaitForAgent_RevokeWakesUpWaiter(t *testing.T) {
+	h := NewNezhaHandler()
+	const streamID = "kill-switch-wait"
+	h.CreateStreamWithPurpose(streamID, 0, 7, PurposeMCPTransfer)
+
+	done := make(chan struct {
+		io  any
+		ok  bool
+		dur time.Duration
+	}, 1)
+
+	start := time.Now()
+	go func() {
+		// 给一个明显大于 revoke 触发延时的 timeout；如果 revoke 没唤醒，
+		// WaitForAgent 会一直等到这里，下面的 assertion 就会失败。
+		stream, ok := h.WaitForAgent(context.Background(), streamID, 5*time.Second)
+		done <- struct {
+			io  any
+			ok  bool
+			dur time.Duration
+		}{stream, ok, time.Since(start)}
+	}()
+
+	// 让 WaitForAgent 真的进入 select 等待，再触发 kill switch。
+	time.Sleep(50 * time.Millisecond)
+	if revoked := h.RevokeStreamsForPurpose(PurposeMCPTransfer); revoked != 1 {
+		t.Fatalf("expected to revoke exactly 1 MCP stream, got %d", revoked)
+	}
+
+	select {
+	case res := <-done:
+		if res.ok {
+			t.Fatalf("WaitForAgent must return ok=false after revoke; got ok=true")
+		}
+		if res.dur > time.Second {
+			t.Fatalf("WaitForAgent did not wake up promptly after revoke (took %s); kill switch is not immediate", res.dur)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatalf("WaitForAgent never returned after revoke; kill switch did not wake the waiter")
+	}
+}