feat: auto-discover MCP servers from project and user config files

Scan .vscode/mcp.json, .mcp.json, .copilot/mcp.json (project-level) and
~/.copilot/mcp.json (user-level) for MCP server definitions. Discovered
servers require explicit user acceptance before activation.

Backend:
- Add ConfigScannerRegistry with per-format scanners and  substitution
- Add discovered tooling domain model with fingerprint-based change detection
- Integrate scanning into workspace load, project add, and project selection
- Merge accepted discovered MCPs into effective runtime tooling
- Extend sidecar contracts with env/headers for real-world MCP configs
- Add IPC channels for accept/dismiss/rescan operations

Frontend:
- Add DiscoveredToolingModal for reviewing pending MCP servers
- Auto-show modal when pending discoveries exist on load or project switch
- Add amber badge on sidebar project headers for pending discoveries
- Add discovered MCP section in Settings panel with accept/dismiss/rescan
- Group InlinePills tool dropdown by Workspace MCP / User MCP / Project MCP
- Pass effective project tooling (including accepted discoveries) to ChatPane

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sidecar/tests/Eryx.AgentHost.Tests/SessionToolingBundleTests.cs

@@ -18,6 +18,10 @@ public sealed class SessionToolingBundleTests
                 Transport = "local",
                 Command = "node",
                 Args = ["server.js", "--stdio"],
+                Env = new Dictionary<string, string>
+                {
+                    ["DEBUG"] = "true",
+                },
                 Cwd = @"C:\workspace\repo",
                 Tools = ["git.status"],
                 TimeoutMs = 1500,
@@ -28,6 +32,10 @@ public sealed class SessionToolingBundleTests
                 Name = "Remote MCP",
                 Transport = "http",
                 Url = "https://example.com/mcp",
+                Headers = new Dictionary<string, string>
+                {
+                    ["Authorization"] = "Bearer token",
+                },
                 Tools = ["*"],
             },
         ];
@@ -38,6 +46,9 @@ public sealed class SessionToolingBundleTests
         Assert.Equal("local", localConfig.Type);
         Assert.Equal("node", localConfig.Command);
         Assert.Equal(["server.js", "--stdio"], localConfig.Args);
+        KeyValuePair<string, string> localEnv = Assert.Single(localConfig.Env!);
+        Assert.Equal("DEBUG", localEnv.Key);
+        Assert.Equal("true", localEnv.Value);
         Assert.Equal(@"C:\workspace\repo", localConfig.Cwd);
         Assert.Equal(["git.status"], localConfig.Tools);
         Assert.Equal(1500, localConfig.Timeout);
@@ -45,6 +56,9 @@ public sealed class SessionToolingBundleTests
         McpRemoteServerConfig remoteConfig = Assert.IsType<McpRemoteServerConfig>(configurations["Remote MCP"]);
         Assert.Equal("http", remoteConfig.Type);
         Assert.Equal("https://example.com/mcp", remoteConfig.Url);
+        KeyValuePair<string, string> remoteHeader = Assert.Single(remoteConfig.Headers!);
+        Assert.Equal("Authorization", remoteHeader.Key);
+        Assert.Equal("Bearer token", remoteHeader.Value);
         Assert.Equal(["*"], remoteConfig.Tools);
     }