feat(mcp): remote MCP servers per chat with sealed keys and owner-only commands

Streamable HTTP/SSE servers from the workspace's .volcanic/mcp/servers.json.
Headers are sealed with AES-GCM; the chat and the visible fields are the
associated data, so only /mcp_add|remove|tools change servers. Tools
<server>__<tool> go live in the session. An unreachable server is skipped
and reported in the system prompt. Keys are redacted from tool results, and
Telegram deletes messages that carry one.

docker-compose.yml

@@ -29,6 +29,7 @@ services:
       - TRIGGER_MODEL=${TRIGGER_MODEL:-}
       - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}              # Google Calendar (calendar spec)
       - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
+      - MCP_ENCRYPTION_SECRET=${MCP_ENCRYPTION_SECRET:-}
       - ADMIN_USER_ID=${ADMIN_USER_ID:-}                    # may /impersonate other users (telegram-bot.md)
       - DEFAULT_TIMEZONE=${DEFAULT_TIMEZONE:-}              # chats' default zone (scheduler spec §7); empty → TZ
       - PROCESS_ENV_ALLOW=${PROCESS_ENV_ALLOW:-}            # deny-listed variables the agent may see, e.g. GH_TOKEN