feat(mcp): add bearer env references and credential persistence - #1663

Summary

Adds two backend pieces toward authenticated remote MCP servers:

1. plugin-link resolves a Bearer token from a deployment environment reference bound to an exact HTTPS MCP URL.
2. The console MCP publication records gain auth_type and credential_ciphertext fields, with authType and hasCredential exposed in the response DTO.

Refs #1661. The stored console credential is not yet consumed by the plugin-link resolver, so this PR does not complete tenant-scoped managed MCP authentication.

Runtime environment-reference path

Tool discovery and calls use the existing initialized_mcp_session path. The resolver reads MCP_SERVER_BEARER_TOKEN_REFS, resolves the named token only in plugin-link, and passes Authorization through the official HTTP/MCP client.

Example non-secret configuration:

MCP_SERVER_BEARER_TOKEN_REFS={"https://gitnexus.internal.example/mcp":"GITNEXUS_MCP_TOKEN"}

Inject GITNEXUS_MCP_TOKEN separately through deployment secret storage.

The map is bounded to 100 entries / 64 KiB; tokens are bounded to visible ASCII / 8 KiB. Invalid configuration fails closed. Configured authenticated endpoints require HTTPS Streamable HTTP, with redirects and SSE fallback disabled. URL user-info is rejected.

Console persistence path

V1.49 adds auth_type and credential_ciphertext to mcp_data. Publication validates the supported auth type and requires a non-empty credential field for bearer before release side effects. The DTO describes the submitted value as RSA-encrypted; this change does not itself encrypt or validate that value. Read DTOs expose hasCredential instead of the ciphertext.

Remaining #1661 requirements

• Connect a tenant/server-scoped credential reference and authorized secret resolution to the actual runtime discovery/call paths; the current resolver reads environment variables, not mcp_data.
• Complete the managed secret input, encryption validation, lifecycle and rotation contract.
• Verify the same credential selection for Agent-bound servers and explicit workflow MCP nodes.
• Cover the full GitNexus HTTPS acceptance fixture, 401 behavior, read-only tool policy, secret redaction and authorization/SSRF boundaries end to end.
• Demonstrate that public APIs, logs, traces and telemetry cannot disclose credentials along the completed persistence-to-runtime path.

Do not close #1661 on the basis of this backend slice.

Validation

Previously recorded on this PR: Python unit suite 220 passed; focused HTTPS suite 35 passed; repository Python formatting/type/lint checks passed; JDK 21 Maven reactor compile passed; McpServiceImplBusinessExceptionTest 2 passed. Deployed GitNexus/Astron E2E has not been established.

The 2026-09-10 maintenance update changes only the title/description after inspecting head cd1ae6a. No source change or fresh local test run is claimed. Current CI details remain in the Checks tab.