feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/rpc/rpc.go

@@ -2,6 +2,7 @@ package rpc
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"net/http"
@@ -21,6 +22,13 @@ import (
 	"github.com/nezhahq/nezha/service/singleton"
 )
 
+// SetMCPKillSwitchObserver re-exports the service/rpc hook so cmd/dashboard
+// can wire singleton.Conf.EnableMCP without importing the inner rpc package
+// (cmd/dashboard already imports cmd/dashboard/rpc for ServeRPC).
+func SetMCPKillSwitchObserver(fn func() bool) {
+	rpcService.SetMCPKillSwitchObserver(fn)
+}
+
 func ServeRPC() *grpc.Server {
 	server := grpc.NewServer(grpc.ChainUnaryInterceptor(getRealIp, waf))
 	rpcService.NezhaHandlerSingleton = rpcService.NewNezhaHandler()
@@ -96,27 +104,30 @@ func DispatchTask(serviceSentinelDispatchBus <-chan *model.Service) {
 				if server == nil {
 					continue
 				}
-				stream := server.GetTaskStream()
-				if stream == nil {
+				if !canSendTaskToServer(task, server) {
 					continue
 				}
-
-				if canSendTaskToServer(task, server) {
-					stream.Send(task.PB())
+				// SendTask 走 holder-scoped send mutex，避免与 cron /
+				// server-transfer / MCP CallAgent / fs.transfer 等并发
+				// SendMsg 同一 RequestTask stream。
+				if err := server.SendTask(task.PB()); err != nil &&
+					!errors.Is(err, model.ErrTaskStreamOffline) {
+					log.Printf("NEZHA>> DispatchTask send error (server=%d): %v", id, err)
 				}
 			}
 		case model.ServiceCoverAll:
-			for id, server := range singleton.ServerShared.Range {
+			// 快照后逐个 SendTask，不在 ServerShared 的 listMu.RLock 内做阻塞
+			// gRPC：否则一个卡死 agent 会拖死需要写锁的 server 生命周期操作。
+			for id, server := range singleton.ServerShared.GetList() {
 				if server == nil || task.SkipServers[id] {
 					continue
 				}
-				stream := server.GetTaskStream()
-				if stream == nil {
+				if !canSendTaskToServer(task, server) {
 					continue
 				}
-
-				if canSendTaskToServer(task, server) {
-					stream.Send(task.PB())
+				if err := server.SendTask(task.PB()); err != nil &&
+					!errors.Is(err, model.ErrTaskStreamOffline) {
+					log.Printf("NEZHA>> DispatchTask send error (server=%d): %v", id, err)
 				}
 			}
 		}
@@ -130,11 +141,10 @@ func DispatchKeepalive() {
 			if s == nil {
 				continue
 			}
-			stream := s.GetTaskStream()
-			if stream == nil {
-				continue
+			if err := s.SendTask(&proto.Task{Type: model.TaskTypeKeepalive}); err != nil &&
+				!errors.Is(err, model.ErrTaskStreamOffline) {
+				log.Printf("NEZHA>> Keepalive send error (server=%d): %v", s.ID, err)
 			}
-			stream.Send(&proto.Task{Type: model.TaskTypeKeepalive})
 		}
 	})
 }
@@ -146,8 +156,7 @@ func ServeNAT(w http.ResponseWriter, r *http.Request, natConfig *model.NAT) {
 		w.Write([]byte("server not found or not connected"))
 		return
 	}
-	stream := server.GetTaskStream()
-	if stream == nil {
+	if server.GetTaskStream() == nil {
 		w.WriteHeader(http.StatusServiceUnavailable)
 		w.Write([]byte("server not found or not connected"))
 		return
@@ -179,7 +188,7 @@ func ServeNAT(w http.ResponseWriter, r *http.Request, natConfig *model.NAT) {
 		return
 	}
 
-	if err := stream.Send(&proto.Task{
+	if err := server.SendTask(&proto.Task{
 		Type: model.TaskTypeNAT,
 		Data: string(taskData),
 	}); err != nil {