…ocation

Adds a new `mcpclient` package that connects to admin-configured MCP
servers and wraps their tools as `fantasy.AgentTool` values. When a
chat has `mcp_server_ids` set, the chat loop now:

1. Loads the MCP server configs from the database
2. Resolves the user's auth tokens (OAuth2/API key/custom headers)
3. Connects to each server via the MCP protocol (streamable HTTP or SSE)
4. Discovers tools via `tools/list`
5. Wraps each tool as an AgentTool with a namespaced name (slug__tool)
6. Appends them to the chat's tool set

The chat loop (`chatloop.Run`) already handles tools generically, so
MCP-backed tools are invoked identically to built-in workspace tools.

Connection failures are logged and skipped — one broken MCP server does
not block the chat. Tool allow/deny lists from the server config are
applied during discovery.

Includes 10 tests covering tool discovery, invocation, filtering,
auth headers, multi-server, connection failure, and edge cases.

Move the MCP server config and user token DB queries into the existing
errgroup that already parallelizes model resolution and message loading.
All four queries hit different tables with no dependencies on each other.

Add TestMCPServerToolInvocation — a full round-trip integration test
that:
1. Starts a real in-process MCP server with an "echo" tool
2. Seeds the MCP server config in the database
3. Creates a chat with mcp_server_ids pointing to it
4. Mocks the LLM to call the MCP tool (test-mcp__echo)
5. Verifies the tool result flows back to the LLM
6. Verifies the tool result is persisted in the database

P1: Fix gofmt formatting issues in chatd.go and chatd_test.go —
over-indented g2.Wait() block, merged line in var block, and
misaligned closing brace.

P2: Add OAuth2 token expiry warning — log when token is expired
and when no token exists for a server/user combo. Still sends
the expired token (refresh is a follow-up), but operators now
have visibility into auth failures.

P2: Fix misleading comment that said oauth2 servers 'will be
skipped during connection' — they actually attempt to connect
without credentials. Updated to describe actual behavior.

P2: Add 60-second per-invocation timeout on MCP tool calls.
External servers may stall indefinitely; this prevents one hung
call from blocking the chat loop forever.

P3: Redact URL userinfo in connection failure logs to avoid
leaking embedded credentials (url.Parse + nil User).

P3: Use map[uuid.UUID] instead of map[string] for token lookup —
avoids string allocations since uuid.UUID is comparable.

P2: Redact URLs in error strings — Go's *url.Error embeds the
full request URL, bypassing the server_url field redaction. Added
redactErrorURL() that unwraps *url.Error and redacts the embedded
URL before logging.

P3: Warn when token record exists but AccessToken is empty (e.g.
incomplete OAuth flow). Previously this silently returned empty
headers.

P3: Strip query params in redactURL in addition to userinfo —
API keys are sometimes passed as ?api_key=sk-... in server URLs.

P3: Add missing test coverage:
- TestRedactURL: table-driven test for URL redaction (userinfo,
  query params, both, invalid URL).
- TestConnectAll_ExpiredToken: verifies expired token warning.
- TestConnectAll_EmptyAccessToken: verifies empty token warning.
- TestConnectAll_CallToolError: verifies MCP-level tool errors
  (IsError=true) are returned as ToolResponse, not Go errors.

Export RedactURL for testability.

- Close client early when zero tools pass filtering (no point
  holding an idle connection).
- Swap empty string to front of case for transport type default
  so the fallback is immediately visible.
- Add comment explaining why buildAuthHeaders uses map[string]string
  rather than http.Header (mcp-go transport options require it).
- Rework convertCallResult to collect all content first, then
  prefer text over binary. Previously binary items short-circuited
  the loop and discarded accumulated text. Now text is always
  returned when present; binary is only used as fallback.

…field

Switch ConnectAll from sync.WaitGroup to errgroup.Group per review
feedback. Cleaner API — goroutines return nil explicitly rather
than using defer wg.Done().

ProviderOptions/SetProviderOptions are required by the
fantasy.AgentTool interface but never set by our code. The
framework calls SetProviderOptions to inject provider-specific
config. Field is kept to satisfy the interface contract.