feat: add default MCP tool and skill IDs to conversation projects

[chenyme]

Summary

Add project-level default MCP tools and Skills configuration.

• Projects can inherit globally starred MCP tools or define a custom MCP selection.
• Projects can define default Skills.
• Defaults apply only when creating a new project conversation and remain adjustable per conversation.
• Preserve manual selections when project data loads asynchronously.
• Store associations in dedicated relational tables with transactional validation and cleanup.
• Clean associations when projects, MCP tools/servers, Skills, or user accounts are deleted.
• Refine the project dialog with searchable selectors, consistent icons, responsive scrolling, and height transitions.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd backend && go test ./...
• cd frontend && pnpm lint
• cd frontend && pnpm exec tsc --noEmit
• git diff --check
• Frontend build was not run per maintainer request.

Screenshots, API examples, or logs

No new screenshot is included. Browser-based visual regression was not performed per maintainer request.

Configuration, migration, and compatibility notes

• Adds mcp_default_mode to chat_conversation_projects.
• Adds chat_conversation_project_mcp_tools.
• Adds chat_conversation_project_skills.
• Existing projects default to inherit, preserving current globally starred MCP behavior.
• No environment variable or deployment configuration changes are required.
• Project API responses and create/update requests now include:
  • mcpDefaultMode
  • defaultMCPToolIDs
  • defaultSkillIDs
• The visible Skills endpoint supports repeated id query parameters.
• Swagger artifacts were regenerated for the API changes.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including project ownership, Skill visibility, MCP availability, deletion cleanup, and API validation.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, API contracts, and migration compatibility are documented.
• Generated artifacts are included only where required for Swagger documentation.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.