feat(agent-core): unify the v1 MCP management plane

[7Sageer]

Related Issue

No GitHub issue — the requirement comes from an internal design doc ("Agent Core V1 MCP 管理面统一", Feishu doc J3jQd3BAaoQNkaxA4PScl8Frn0e). The problem is summarized below.

Problem

v1 has two MCP server sources that only merge at session start: global servers (three-layer mcp.json files + SDK caller injection) and plugin servers (manifest mcpServers + install state). The management plane only sees the user-level file, so:

• The 11 global management RPCs (list / CRUD / connection test / OAuth) don't cover plugin servers at all — no connection test, no proactive login/reset, no runtime status view, no effective-config query.
• Config writes only touch the file: live sessions never learn about adds/updates/removes, and a plugin disabled at runtime can still be reconnected inside an open session (reconnects reuse the boot-time snapshot).
• OAuth sign-in / credential reset never reaches live sessions; a server stays needs-auth until a manual reconnect.
• Tokens carry no absolute expiry, so "authorized" is a file-existence guess — a dead refresh token still reports oauth-authorized, and a mid-session 401 is reported as a generic connection failure.

What changed

Unified config registry (packages/agent-core/src/mcp/registry.ts): every server — global (layered files), plugin (manifests), caller (SDK injection) — is exposed with source / origin / mutable and its final effective config; the plugin rename / env-injection / cwd-constraint transforms stay inside PluginManager.mcpServerEntries(). All management lookups go through the registry: queries cover plugin servers, mutations on read-only entries are rejected with an actionable error, and getGlobalMcpServer exposes the effective config. Global CRUD and plugin install/enable/disable/remove/reload now push into every live session (upsert / remove / reconnect-on-change).

Interface extensions (name + full config): testGlobalMcpServer accepts an inline unsaved config; new addSessionMcpServer (name + full config + persist flag); reconnectMcpServer accepts a replacement config, and a name-only reconnect re-resolves the current config from the registry.

OAuth conduction & status semantics: one process-wide McpOAuthService shared by core and all sessions; token writes are stamped with obtained_at so expiry is computable; refresh runs ahead of expiry and single-flight per credential; credential events (saved / invalidated / refresh-failed) are pushed into affected sessions automatically. Mid-session 401s classify as needs-auth; listGlobalMcpServerAuthStatuses supports verify (online probe) and the new oauth-expired state.

SDK: the surface is exposed on both clients (getMcpServer, testMcpServerConfig, session addMcpServer, reconnectMcpServer(name, config), cwd / verify options, source-tagged list entries). v2-client limitations (no source/config tags on session entries, workspace-shared session adds) are documented in its header comment and pinned in the parity test's KNOWN_DIFFS.

Relationship to #2856: this PR's second commit absorbs that PR's v1 side — inspectAppMcpServers, the locator-addressed OAuth RPCs, and reconnectAndJoin are ported and implemented over the unified registry (its McpOAuthCoordinator and PluginManager.mcpServers() are superseded by the service's built-in credential events and mcpServerEntries(); the inspection also reports dead grants as oauth-expired rather than oauth-required). What remains unique to #2856 after this: the v2-engine credential propagation (IMcpAuthCoordinator driving workspace MCP reconnects), which is orthogonal and can land separately.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works. (test/mcp/registry.test.ts, test/mcp/oauth-service.test.ts, test/rpc/mcp-rpc.test.ts, connection-manager / session-config / node-sdk / parity suites; full repo suite green: 18327 passed.)
• Ran gen-changesets skill, or this PR needs no changeset. (.changeset/v1-mcp-management-plane.md)
• Ran gen-docs skill, or this PR needs no doc update. (docs/{en,zh}/customization/mcp.md: plugin server changes now take effect in open sessions immediately.)