feat(mcp): connect authenticated AquaPortal tools to Vocero (#1)

Vocero needs to query AquaPortal on behalf of the caller selected by the existing phone link. This adds server-owned conversations and MCP tool execution for voice and HTTP reasoning while leaving the speech pipeline unchanged.

Release notes:

- Added browser-bound conversations that keep backend credentials server-side and isolate callers.
- Connected the eight-tool AquaPortal catalog through authenticated Streamable HTTP with full input schemas and structured results.
- Added bounded multi-step tool execution with cancellation, expiry, and stale-result protection.
- Updated browser bootstrap, tool progress, reasoning headers, and conversation cleanup.
- Disabled legacy unscoped content preloads in MCP mode and documented configuration and deployment constraints.
- Preserved disabled-mode contracts and added local SDK, WebSocket, and browser regression coverage.

Reviewed-on: AquaPortal/s2s#1

vocero-api/tests/test_compatibility.py

@@ -568,6 +568,21 @@ class LegacyCompatibilityTests(unittest.TestCase):
         for name, response in actual["http"].items():
             with self.subTest(case=name):
                 self.assertEqual(response, expected["http"][name])
+        # Additive conversation/MCP routes have their own contract tests. Every
+        # pre-existing operation and request schema still matches the capture.
+        operations = actual["openapi_requests"]["operations"]
+        added = set(operations) - set(expected["openapi_requests"]["operations"])
+        self.assertEqual(
+            added,
+            {
+                "POST /api/conversations",
+                "DELETE /api/conversations/current",
+                "POST /api/conversations/current/interrupt",
+                "GET /api/mcp/tools",
+            },
+        )
+        for key in added:
+            del operations[key]
         self.assertEqual(actual["openapi_requests"], expected["openapi_requests"])
         self.assertEqual(actual["realtime"], expected["realtime"])
         self.assertEqual(set(actual["http"]), set(expected["http"]))