feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

service/rpc/mcp_rpc_kill_switch_race_test.go

@@ -0,0 +1,95 @@
+package rpc
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/nezhahq/nezha/model"
+	pb "github.com/nezhahq/nezha/proto"
+)
+
+// Kill switch must beat a late agent reply. Without the cancelled-flag
+// re-check in CallAgent, the following sequence surfaces success after
+// EnableMCP=false:
+//
+//	t0  agent puts TaskResult into resultCh (capacity 1, non-blocking)
+//	t1  admin flips EnableMCP=false → CancelAllMCPInflight closes cancelCh
+//	t2  CallAgent's select sees BOTH cases ready; Go picks one at random;
+//	    if it picks resultCh, the call returns the agent's payload even
+//	    though the operator's kill switch fired.
+//
+// The fix is to mark the entry cancelled BEFORE closing cancelCh and have
+// the resultCh branch re-check that flag. This test pins the contract by
+// driving the worst-case ordering: result is delivered FIRST, then the
+// kill switch fires, then CallAgent observes both. With the race in place
+// this would flake (random select); with the fix it always returns
+// ErrMCPDisabled.
+func TestCallAgent_KillSwitchBeatsConcurrentLateResult(t *testing.T) {
+	const target uint64 = 7301
+
+	stream := newFakeStream()
+	cleanup := installFakeServer(t, target, stream)
+	defer cleanup()
+
+	delivered := make(chan struct{})
+	go func() {
+		sent := <-stream.sent
+		deliverMCPResultFromReporter(&pb.TaskResult{
+			Id:         sent.GetId(),
+			Type:       model.TaskTypeExec,
+			Successful: true,
+			Data:       `{"exit_code":0,"stdout":"should-not-surface"}`,
+		}, target)
+		CancelAllMCPInflight()
+		close(delivered)
+	}()
+
+	_, err := CallAgent(context.Background(), target, model.TaskTypeExec,
+		model.ExecRequest{Cmd: "x"}, 2*time.Second)
+	<-delivered
+	if !errors.Is(err, ErrMCPDisabled) {
+		t.Fatalf("kill switch must win the race with a late agent reply; want ErrMCPDisabled, got %v", err)
+	}
+}
+
+// CancelAllMCPInflight must eagerly evict entries so a stale TaskResult
+// that arrives after the kill switch cannot still land in resultCh.
+// Without the cancelled flag this entry would still be reachable through
+// deliverMCPResultFromReporter; the flag guarantees the late delivery is
+// silently dropped even if the caller has not returned yet.
+func TestCancelAllMCPInflight_LaterResultIsSwallowed(t *testing.T) {
+	const target uint64 = 7302
+
+	stream := newFakeStream()
+	cleanup := installFakeServer(t, target, stream)
+	defer cleanup()
+
+	taskIDCh := make(chan uint64, 1)
+	go func() {
+		sent := <-stream.sent
+		taskIDCh <- sent.GetId()
+	}()
+
+	resultCh := make(chan error, 1)
+	go func() {
+		_, err := CallAgent(context.Background(), target, model.TaskTypeExec,
+			model.ExecRequest{Cmd: "x"}, 5*time.Second)
+		resultCh <- err
+	}()
+
+	taskID := <-taskIDCh
+	CancelAllMCPInflight()
+
+	if err := <-resultCh; !errors.Is(err, ErrMCPDisabled) {
+		t.Fatalf("CallAgent must return ErrMCPDisabled after kill switch; got %v", err)
+	}
+
+	deliverMCPResultFromReporter(&pb.TaskResult{
+		Id:         taskID,
+		Type:       model.TaskTypeExec,
+		Successful: true,
+		Data:       `{"exit_code":0}`,
+	}, target)
+}