feat(mcp): connect authenticated AquaPortal tools to Vocero (#1)

Vocero needs to query AquaPortal on behalf of the caller selected by the existing phone link. This adds server-owned conversations and MCP tool execution for voice and HTTP reasoning while leaving the speech pipeline unchanged.

Release notes:

- Added browser-bound conversations that keep backend credentials server-side and isolate callers.
- Connected the eight-tool AquaPortal catalog through authenticated Streamable HTTP with full input schemas and structured results.
- Added bounded multi-step tool execution with cancellation, expiry, and stale-result protection.
- Updated browser bootstrap, tool progress, reasoning headers, and conversation cleanup.
- Disabled legacy unscoped content preloads in MCP mode and documented configuration and deployment constraints.
- Preserved disabled-mode contracts and added local SDK, WebSocket, and browser regression coverage.

Reviewed-on: AquaPortal/s2s#1

vocero-api/vocero_api/api/routes/config.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from fastapi import APIRouter, Request
+from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse
 
 from vocero_api.api.responses import validated_json_response
@@ -44,6 +44,13 @@ async def config(request: Request) -> JSONResponse:
         "theme": settings.S2S_THEME,
         "apipilot": bool(settings.S2S_APIPILOT_TOOLS_URL),
     }
+    if settings.S2S_MCP_URL:
+        if settings.S2S_REASONING_TYPE == "PROXY" and (
+            not settings.S2S_PROXY_TARGET or settings.SPEECH_TO_SPEECH_URL or settings.LOAD_BALANCER_URL
+        ):
+            raise HTTPException(503, "MCP en modo PROXY requiere la conexión de voz a través de Vocero.")
+        out["mcp"] = True
+        out["apipilot"] = False
     app_logging.logger.debug(
         "[INTERNAL] /api/config returned promptLen=%d reasoning=%s startSessionMode=%s theme=%s apipilot=%s",
         len(primary_prompt),