MCP v2: authenticated tools (MyOpenCRE, chat) matching REST authz

Follow-up to #1003

v1 (public stdio MCP, no auth) shipped in #1013 and is documented in docs/api/mcp.md. This ticket tracks the remaining product from #1003.

Expose authenticated OpenCRE REST through MCP with the same authz as REST (no MCP bypass secret).

Deferred from v1:

MyOpenCRE GET/PUT /rest/v1/user/resources
Chat POST /rest/v1/completion
Admin / import tools
Cookie / PAT / OAuth / session forwarding
Extra public GETs still not in the allowlist (gap analysis, CSV, section path variants) — only if we still want them as tools

REST stays the execution and authorization boundary
Fixed allowlist in application/mcp/catalog.py — OpenAPI membership alone must not expose a tool
No credentials in tool arguments; no caller-supplied base URL / method / path
Start from the existing stdio server (python -m application.mcp); remote transport is optional later

Parent: #1003 · v1 PR: #1013

Hi ,I'd like to work on the ticket. Please assign this ticket to me.

@Abhijeet2409

Actually @Abhijeet2409 I was working on this PR , if you want you may discuss you approach with me on slack

@Pa04rth

That's great, @Pa04rth! Thanks for letting me know.