chore(vocero): remove the legacy ApiPilot integration (#3)

Vocero now retrieves AquaPortal content through authenticated MCP. This removes the obsolete ApiPilot integration from the API and browser while preserving the separately deployed speech pipeline.

Release notes:

- Removed ApiPilot endpoints, configuration, credential overrides, and HTTP/realtime tool execution.
- Removed browser ApiPilot catalog loading and prompt generation while retaining authenticated MCP discovery.
- Updated regression coverage and operating documentation for the retired routes and settings.

Reviewed-on: AquaPortal/s2s#3

docs/client/reasoning.md

@@ -19,8 +19,9 @@ with `config.primaryPrompt || settings.instructions`. `/api/config` pins
 `DEFAULT_INSTRUCTIONS` is used. The current server does not fetch a remote agent
 profile to choose this base prompt.
 
-The browser adds caller context when `injectProfile` is enabled, custom RAG text
-when the operator has applied it, and an available ApiPilot catalog block.
+The browser adds caller context when `injectProfile` is enabled and custom RAG
+text when the operator has applied it. In MCP mode, the server constructs tool
+instructions from the authenticated conversation's catalog and content selection.
 `speechInstructions()` adds the speech-rendering hint only in `OPENAI` mode.
 The WebSocket client packages these instructions in `session.update.session`;
 the local proxy may then add server-resolved context. Details belong in
@@ -30,13 +31,14 @@ the local proxy may then add server-resolved context. Details belong in
 
 The realtime backend receives session instructions and enabled native tools,
 then processes each voice turn through STT, model generation and TTS.
-Native function-call events are executed by the browser. ApiPilot also has a
+Native function-call events are executed by the browser. Authenticated MCP has a
 separate marker-based path handled by the local proxy. These are distinct
 protocols, described in [tool calling](tool-calling.md).
 
 Using a direct browser URL bypasses local WebSocket proxy processing. Browser
 instructions still apply, but server-side session context and marker execution
-require the local `/v1/realtime` route.
+require the local `/v1/realtime` route. MCP in `PROXY` mode requires this relay;
+configuration rejects a pinned direct URL or load-balancer bypass.
 
 ## OpenAI-compatible HTTP reasoning
 
@@ -53,12 +55,14 @@ is a runtime default, not a recommendation about provider availability.
 `VoiceController.reason()` in [controller.ts](../../vocero-frontend/src/realtime/controller.ts)
 runs after a complete user transcript and posts a body with `transcript`,
 `instructions`, `language`, `user_context`, `phoneNumber`, and `episode_id`.
-The server combines instructions and context into model messages, requests a
-final answer with a 30-second timeout, and returns `answer`. ApiPilot can
-append discovery instructions, execute a detected call marker, and request a
-second response based on the tool result, including available `usage_pass2`
-metadata. The endpoint does not forward the browser's native `session.tools`
-catalog as OpenAI Chat Completions `tools`.
+Without MCP, the server combines instructions and context into model messages,
+requests a final answer with a 30-second timeout, and returns `answer`.
+With MCP, the browser also sends conversation and turn headers. The server uses
+that conversation's backend token, linked/current content, and bounded history
+to run tool selections before returning `answer`. This path has a 180-second
+total timeout and configured per-operation limits. Retired ApiPilot execution
+metadata is no longer returned. The endpoint does not forward the browser's
+native `session.tools` catalog as OpenAI Chat Completions `tools`.
 
 For an external answer, the browser cancels/suppresses the active native
 response and appends the external assistant text. It uses browser
@@ -78,5 +82,6 @@ realtime backend instead.
 | Change the base agent prompt | `S2S_PRIMARY_PROMPT` or browser settings when unpinned |
 | Change browser context assembly | `buildInstructions()` in `vocero-frontend/src/lib/context.ts` |
 | Change HTTP provider messages | `reasoning()` in `vocero-api/vocero_api/services/reasoning.py` |
+| Change MCP reasoning or tool context | `vocero-api/vocero_api/services/mcp_reasoning.py` and `vocero-api/vocero_api/services/mcp_tools.py` |
 | Change external-answer rendering | `VoiceController.reason()` and `RealtimeClient.renderExternalAnswer()` |
 | Change native model/tool generation | `speech_to_speech/LLM` and realtime handlers |