feat: add MCP token management UI to My Tokens page

[sap-yuan]

Summary

• Add MCP token CRUD to UserTokenService.js — 4 new methods wiring up the /api/v1/mcp/tokens/* endpoints added in DIARCHERS-1396: MCP-dedicated API layer with rate limiting, auth, and audit #610
• Append a MCP Tokens card to the existing /user/tokens page (UserGlobalTokens.vue) — no new route needed
• Post-create dialog shows the ib_mcp_* token value (shown once) with a INFRABOX_MCP_TOKEN=... usage hint for the MCP client

What users can do after this PR

1. Open My Tokens in the sidebar
2. Scroll down to the MCP Tokens section
3. Create a token with a name and validity period
4. Copy the ib_mcp_* value and set INFRABOX_MCP_TOKEN in their MCP client config
5. Toggle trigger permission per-token via a switch
6. Revoke tokens when no longer needed

Related

Completes the frontend half of DIARCHERS-1396 / #610 (backend MCP API layer).

[liuwei08]

Two bugs that must be fixed before merge — see inline comments.

[liuwei08]

Bug: switch visual state and data state can diverge on API failure.

vue-material's md-switch fires its @change handler and flips its visual state before the API call resolves. If setMcpTrigger rejects, token.allow_trigger is never mutated in the .then, but the switch already looks toggled to the user.

Fix — revert the visual state on failure:

toggleMcpTrigger (token) {
    const newVal = !token.allow_trigger
    UserTokenService.setMcpTrigger(token.token_id, newVal)
        .then(() => { token.allow_trigger = newVal })
        .catch(() => {
            // Revert: force Vue to re-render the switch at the original value
            token.allow_trigger = !newVal
        })
}

[liuwei08]

Bug: previous token value leaks if dialog is reopened.

newMcpToken is never cleared after the dialog closes. If the user creates a second token but this dialog re-renders before fully reinitializing, the previous ib_mcp_* value will briefly be visible.

Fix — clear newMcpToken in the click handler:

<md-button class="md-primary" @click="$refs['mcpTokenDialog'].close(); newMcpToken = ''">OK</md-button>

Or better, wire a dedicated close method so cleanup is explicit and testable:

closeMcpTokenDialog () {
    this.$refs['mcpTokenDialog'].close()
    this.newMcpToken = ''
}

[sap-yuan]

Fixed in 902bf9b:

1. Trigger switch revert on failure — added .catch(() => { token.allow_trigger = !newVal }) to revert visual state if the API call fails
2. Token value leak on dialog reopen — extracted closeMcpTokenDialog() method that calls .close() and clears newMcpToken = ''; wired the OK button to this method