feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/controller/mcp_transfer_failure_audit_test.go

@@ -0,0 +1,147 @@
+package controller
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/nezhahq/nezha/model"
+	"github.com/nezhahq/nezha/service/singleton"
+)
+
+// fs.upload / fs.download 失败路径必须写一条 MCPAuditLog，否则审计表只能看到
+// 成功调用，运营无法发现"PAT 被吊销后仍有人尝试消费 URL"、"agent 拒绝执行"、
+// "kill switch 已开却仍有调用打进来"这类信号。成功路径已经在写审计，这里把
+// 失败路径的契约钉死。
+
+func countAuditRows(t *testing.T, tool, outcome string) int64 {
+	t.Helper()
+	var cnt int64
+	q := singleton.DB.Model(&model.MCPAuditLog{}).Where("tool = ?", tool)
+	if outcome != "" {
+		q = q.Where("outcome = ?", outcome)
+	}
+	require.NoError(t, q.Count(&cnt).Error)
+	return cnt
+}
+
+func newTransferRouter(t *testing.T) *gin.Engine {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.GET("/mcp/download/:token", transferDownloadHandler)
+	r.POST("/mcp/upload/:token", transferUploadHandler)
+	return r
+}
+
+func TestTransferDownload_AuditsTokenExpired(t *testing.T) {
+	cleanup, uid := setupMCPTest(t)
+	defer cleanup()
+	tok, _ := mkToken(t, uid, []string{model.ScopeServerRead}, nil)
+	r := newTransferRouter(t)
+
+	url, err := mintTransferToken(transferEntry{
+		UserID:    uid,
+		TokenID:   tok.ID,
+		ServerID:  7,
+		Path:      "/srv/blob",
+		Direction: transferDirDownload,
+		ExpiresAt: time.Now().Add(-time.Second),
+	})
+	require.NoError(t, err)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/mcp/download/"+url, nil)
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusUnauthorized, w.Code,
+		"expired token must surface as 401 to client")
+	require.Equal(t, int64(1), countAuditRows(t, "fs.download", ""),
+		"failed download must still produce an audit row so SIEM can observe the rejection")
+}
+
+func TestTransferDownload_AuditsRevalidateFailureWhenMCPDisabled(t *testing.T) {
+	cleanup, uid := setupMCPTest(t)
+	defer cleanup()
+	tok, _ := mkToken(t, uid, []string{model.ScopeServerRead}, nil)
+	r := newTransferRouter(t)
+
+	url, err := mintTransferToken(transferEntry{
+		UserID:    uid,
+		TokenID:   tok.ID,
+		ServerID:  7,
+		Path:      "/srv/blob",
+		Direction: transferDirDownload,
+		ExpiresAt: time.Now().Add(5 * time.Minute),
+	})
+	require.NoError(t, err)
+	singleton.Conf.SetMCPEnabled(false)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/mcp/download/"+url, nil)
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusUnauthorized, w.Code)
+	require.Equal(t, int64(1),
+		countAuditRows(t, "fs.download", model.MCPOutcomeMCPDisabled),
+		"kill switch must be observable in audit log with outcome=mcp_disabled, not silently swallowed")
+}
+
+func TestTransferUpload_AuditsTokenExpired(t *testing.T) {
+	cleanup, uid := setupMCPTest(t)
+	defer cleanup()
+	tok, _ := mkToken(t, uid, []string{model.ScopeServerWrite}, nil)
+	r := newTransferRouter(t)
+
+	url, err := mintTransferToken(transferEntry{
+		UserID:    uid,
+		TokenID:   tok.ID,
+		ServerID:  7,
+		Path:      "/srv/blob",
+		Direction: transferDirUpload,
+		ExpiresAt: time.Now().Add(-time.Second),
+	})
+	require.NoError(t, err)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/mcp/upload/"+url, strings.NewReader(""))
+	req.ContentLength = 0
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusUnauthorized, w.Code)
+	require.Equal(t, int64(1), countAuditRows(t, "fs.upload", ""),
+		"failed upload must still produce an audit row")
+}
+
+func TestTransferUpload_AuditsRevalidateFailureWhenMCPDisabled(t *testing.T) {
+	cleanup, uid := setupMCPTest(t)
+	defer cleanup()
+	tok, _ := mkToken(t, uid, []string{model.ScopeServerWrite}, nil)
+	r := newTransferRouter(t)
+
+	url, err := mintTransferToken(transferEntry{
+		UserID:    uid,
+		TokenID:   tok.ID,
+		ServerID:  7,
+		Path:      "/srv/blob",
+		Direction: transferDirUpload,
+		ExpiresAt: time.Now().Add(5 * time.Minute),
+	})
+	require.NoError(t, err)
+	singleton.Conf.SetMCPEnabled(false)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/mcp/upload/"+url, strings.NewReader(""))
+	req.ContentLength = 0
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusUnauthorized, w.Code)
+	require.Equal(t, int64(1),
+		countAuditRows(t, "fs.upload", model.MCPOutcomeMCPDisabled),
+		"upload kill switch must be observable in audit log")
+}