feat(mcp): connect authenticated AquaPortal tools to Vocero (#1)

Vocero needs to query AquaPortal on behalf of the caller selected by the existing phone link. This adds server-owned conversations and MCP tool execution for voice and HTTP reasoning while leaving the speech pipeline unchanged.

Release notes:

- Added browser-bound conversations that keep backend credentials server-side and isolate callers.
- Connected the eight-tool AquaPortal catalog through authenticated Streamable HTTP with full input schemas and structured results.
- Added bounded multi-step tool execution with cancellation, expiry, and stale-result protection.
- Updated browser bootstrap, tool progress, reasoning headers, and conversation cleanup.
- Disabled legacy unscoped content preloads in MCP mode and documented configuration and deployment constraints.
- Preserved disabled-mode contracts and added local SDK, WebSocket, and browser regression coverage.

Reviewed-on: AquaPortal/s2s#1

vocero-api/pyproject.toml

@@ -15,6 +15,8 @@ dependencies = [
   "python-dotenv==1.2.2",
   "pydantic==2.13.5",
   "websockets==17.2",
+  "mcp==1.29.0",
+  "jsonschema==4.26.0",
 ]
 
 [dependency-groups]
@@ -23,6 +25,7 @@ dev = [
   "pre-commit>=4.4,<5",
   "pytest>=9,<10",
   "ruff>=0.12,<1",
+  "types-jsonschema>=4.26.0.20261006",
 ]
 
 [tool.uv]