feat(connect): stat-only overall status + on-demand content reads (US1) (#706)

Related #696

Spec 075 US1. Connect overall status (GetAllStatus) now determines each
client's installed state via os.Stat metadata only and performs ZERO config
content reads, eliminating the macOS "wants to access data from other apps"
privacy prompt storm when simply viewing status (FR-001, SC-001/SC-002).

Reading a client's config contents to detect whether mcpproxy is registered
now happens only on an explicit per-client action via the new GetStatus(id),
which resolves Connected + AccessState (FR-002).

## Changes
- Add a content-read seam: Service.readFile (default os.ReadFile) +
  NewServiceWithReader / setReadFile so tests inject reads/denials.
- ClientStatus gains additive access_state + remediation fields (FR-006).
- GetAllStatus: metadata-only existence; AccessState="unknown", Connected=false
  for installed clients (eager findEntry removed).
- GetStatus(clientID): single on-demand content read via the seam; resolves
  accessible/absent/malformed and Connected.
- Route all content reads (readOrCreate*, disconnect*, verifyJSONEntry,
  entry-finders) through the seam; entry-finders parse bytes only.
- GetConnectedCount/GetConnectedIDs re-implemented to read lazily per client.
- CLI `mcpproxy connect` resolves Connected on demand (explicit action),
  preserving the CONNECTED column.

## Testing
- New TestGetAllStatus_NoContentReads (reader asserts 0 calls),
  TestGetStatus_ReadsSingleClientOnDemand (exactly 1 read), plus absent /
  malformed / unknown-client cases.
- Migrated GetAllStatus connected-detection tests to GetStatus.
- go test ./internal/connect/... ./internal/httpapi/... -race green;
  golangci-lint v2 clean; build (personal+server) ok; API E2E 65/65 pass.

Author: Dumbris

cmd/mcpproxy/connect_cmd.go

@@ -132,7 +132,19 @@ func runDisconnect(cmd *cobra.Command, args []string) error {
 }
 
 func printConnectStatus(svc *connect.Service, formatter clioutput.OutputFormatter, format string) error {
+	// Spec 075: GetAllStatus is content-read-free and leaves Connected/AccessState
+	// unresolved. Running `mcpproxy connect` is an explicit user action, so resolve
+	// each supported+installed client's connected state on demand via GetStatus to
+	// preserve the CONNECTED column. Unsupported/absent clients keep the cheap
+	// metadata-only listing (no content read).
 	statuses := svc.GetAllStatus()
+	for i := range statuses {
+		if statuses[i].Supported && statuses[i].Exists {
+			if st, err := svc.GetStatus(statuses[i].ID); err == nil {
+				statuses[i] = st
+			}
+		}
+	}
 
 	if format == "table" {
 		headers := []string{"CLIENT", "STATUS", "CONFIG PATH", "CONNECTED"}

docs/api/rest-api.md

@@ -634,6 +634,32 @@ Success returns `data.server` (`name`, `protocol`, `command`, `args`, `url`,
 Drop a registry's cached server lists. Returns
 `{ "registry_id": "...", "cleared": <n> }`.
 
+### Connect (client wizard)
+
+#### GET /api/v1/connect
+
+Lists the connection status of every known MCP client (Claude Desktop, Cursor,
+VS Code, Codex, Gemini, OpenCode, …).
+
+As of Spec 075, the overall listing determines each client's installed state
+using **file-existence metadata only** (`os.Stat`) and performs **zero config
+content reads** — so simply viewing status never triggers the macOS
+"wants to access data from other apps" privacy prompt. Each per-client object is
+additive-compatible and gains two fields:
+
+| Field | Type | Meaning |
+|-------|------|---------|
+| `exists` | bool | Config file present (metadata only). |
+| `connected` | bool | mcpproxy registered in the config. Authoritative **only** when `access_state == "accessible"`; `false`/unresolved in the overall listing. |
+| `access_state` | string | `"unknown"` in the overall listing (not content-checked); resolved to `"accessible"`, `"absent"`, or `"malformed"` by an on-demand single-client read. |
+| `remediation` | string | Present only when access is denied (populated by later stories). |
+
+A client that is installed but not yet content-checked reads as
+`exists=true, connected=false, access_state="unknown"`. Resolving `connected`
+requires an explicit per-client read (connect/disconnect, or the CLI
+`mcpproxy connect` command), which is the only place a privacy prompt may
+legitimately appear.
+
 ### Real-time Updates
 
 #### GET /events