feat(mcp): native Gmail adapter — §6.5 profile over GA REST as stdio MCP server (#1449)

* feat(mcp): native Gmail adapter — six-tool §6.5 profile over Gmail REST as stdio MCP server

Capability Plugin per ADR §5.3/§6.1 and rollout step 5, motivated by live
validation (PR #1448): hosted Gmail MCP gates tools/call behind Workspace
Developer Preview enrollment and its terms bar pre-GA shipping, while the
same OAuth token works against GA Gmail REST.

- crates/openab-mcp/src/native/gmail.rs: search_threads / get_thread /
  get_message / list_labels / list_drafts / create_draft with names and
  argument shapes mirroring the hosted server (GA cut-over = config-only);
  drafts-only write surface; header-injection-hardened MIME builder;
  Gmail-id validation before path use.
- Own OAuth login (PKCE S256 paste-back) sending access_type=offline +
  prompt=consent — stores a refresh token (the rmcp-driven flow cannot),
  single-flight refresh with rotation-tolerant persistence via the shared
  auth.json McpCredentialStore under the gmail-native key.
- Served over stdio (openab-agent gmail-native serve|login): registered in
  mcp.json as a normal stdio server, so tool_filter, schema validation,
  breaker, timeouts, and redaction apply unchanged.

* style: cargo fmt + fix injection-test assertion (address guard trips on control char first)

* style: final rustfmt

* refactor(gmail-native): serve over loopback Streamable HTTP instead of stdio

Same transport and trust model as the OAB MCP Facade (require_loopback
reused; non-loopback binds refused; no auth layer — host boundary is the
trust boundary). mcp.json registration becomes a "type": "http" entry at
http://127.0.0.1:8850/mcp. Drops the rmcp transport-io feature.

* docs: gmail-native operator guide (setup, registration, security notes)

* refactor: move gmail-native serve|login to the broker binary

openab-agent is the coding agent (ACP client + MCP client toolchain);
long-running serving surfaces belong to the broker binary, which every
bot image already ships — the b2 validation required smuggling the agent
binary into the container precisely because the adapter lived on the
wrong binary. openab-agent keeps the client-side mcp CLI only.

* style: fmt + doc reference fix

* refactor(cli): nest under `openab mcp <addon> <action>` namespace

Maintainer direction: MCP add-ons get one namespace (openab mcp
gmail-native serve|login); long-running serving remains config-driven
([mcp] + openab run). Standalone/dev serving and interactive logins are
the namespace's job.

* style: fmt

---------

Co-authored-by: chaodu-agent <chaodu-agent@users.noreply.github.com>

Author: chaodu-agent

crates/openab-mcp/src/lib.rs

@@ -24,3 +24,4 @@ pub mod acp;
 pub mod auth;
 pub mod llm;
 pub mod mcp;
+pub mod native;

crates/openab-mcp/src/mcp/facade.rs

@@ -316,7 +316,7 @@ impl ServerHandler for McpFacade {
 /// Reject any bind address that is not loopback (ADR §6.2: the facade must
 /// never listen on a non-loopback interface — it has no authentication
 /// layer; the host boundary is the trust boundary).
-fn require_loopback(addr: &str) -> Result<std::net::SocketAddr> {
+pub(crate) fn require_loopback(addr: &str) -> Result<std::net::SocketAddr> {
     let sock: std::net::SocketAddr = addr
         .parse()
         .with_context(|| format!("invalid listen address {addr:?} (expected ip:port)"))?;