feat: implement MCP tool grouping and search functionality

[chenyme]

Summary

Add grouped MCP tool selection in the chat composer and make the per-message MCP tool selection limit configurable from the admin console.

This keeps the existing backend contract based on selectedToolIDs, while improving the frontend selection flow by grouping tools by MCP server, supporting service-level select/clear, search, expand/collapse animation, and clear limit feedback. The backend now exposes and enforces the configured MCP selection policy consistently.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd backend && go test ./...
• cd frontend && pnpm lint features/chat/hooks/use-chat-model-options.ts features/chat/components/app-chat-area.tsx features/chat/components/sections/chat-input.tsx features/chat/components/sections/chat-mcp.tsx features/admin/model/tool-settings.ts
• cd frontend && pnpm build
• make swagger
• git diff --check

Screenshots, API examples, or logs

Not included.

Configuration, migration, and compatibility notes

Adds a dynamic MCP setting:

• mcp.mcp_max_selected_tools_per_message
• Default: 32
• Allowed range: 1-128

No database migration is required. Existing MCP tools and message sending continue to use selectedToolIDs. The frontend reads the runtime MCP policy from /api/v1/settings/mcp-policy, and the backend enforces the same limit during message send.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Swagger was regenerated for the new MCP policy endpoint.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

The selected MCP tool limit is enforced on the backend and capped at a safe maximum to avoid exposing an excessive number of tool schemas in a single model request.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.