feat(mcp-tools): ScholiqToolProvider — AI companion MCP tools (MVP skeleton) (#39)

First per-app implementation of OCA\OpenRegister\Mcp\IMcpToolProvider for
Scholiq (LVS + LMS). Scholiq handles student data, which is privacy
sensitive — so the MVP deliberately ships ONLY the two least sensitive,
read-only tools (the course catalogue and a course's module structure):

- scholiq.listCourses     — list visible courses (catalogue only, no
  learner data); optional limit (1-50, capped at 20) + status filter.
- scholiq.getCourseDetails — one course by id/uuid/slug with its ordered
  module (Lesson) structure; course + module metadata only — never
  Enrolment, Attestation, Credential or learner objects.

Tools that touch learner records are deferred to a follow-up that wires
proper per-student authorisation (a teacher of that learner's group, the
learner themself, or an admin).

Architecture (hydra ADR-034 + ADR-035):
- lib/Mcp/ScholiqToolProvider.php delegates to OR's ObjectService (same
  pattern existing scholiq controllers/handlers already use); injects
  IUserSession + IGroupManager for the auth gate, LoggerInterface for
  error logging.
- Tool ids namespaced scholiq.{tool}; getTools() always returns the full
  catalogue; per-request authorisation runs in invokeTool() AFTER argument
  validation but BEFORE business logic. requireCourseReadAccess() rejects
  anonymous callers; OpenRegister RBAC inside ObjectService is the second,
  per-object gate (so _rbac/_multitenancy stay at their default true).
- invokeTool() never throws — all failure paths return a structured error
  array (invalid_arguments / forbidden / not_found / internal_error /
  unknown_tool).
- Application.php registers the alias
  'OCA\OpenRegister\Mcp\IMcpToolProvider::scholiq' → ScholiqToolProvider.

Until openregister PR #1466 (ai-chat-companion-orchestrator) ships the
real interface, Scholiq implements the stub at
tests/Stubs/Mcp/IMcpToolProvider.php (loaded by tests/bootstrap.php and
tests/bootstrap-unit.php when the interface isn't autoloadable).

Tests: tests/Unit/Mcp/ScholiqToolProviderTest.php — 8 tests / 58
assertions: getAppId, catalogue shape, unknown-tool error envelope (no
throw), argument validation, the anonymous-caller forbidden path, and a
happy-path getCourseDetails that asserts no learner-PII keys leak.

Static analysis: psalm.xml suppresses Undefined-class for the
IMcpToolProvider interface; phpstan.neon scans tests/Stubs so the
cross-app interface resolves, plus broadens the existing OpenRegister
ignore patterns ('unknown interface', 'has invalid type') — which also
clears some pre-existing CredentialIssuanceHandler/XapiCompletionHandler
noise.

Widget mount: bumps @conduction/nextcloud-vue to ^1.0.0-beta.30 (scholiq
already mounts CnAppRoot, which surfaces the AI chat companion from the
manifest's openregister dependency — no extra scaffolding needed).

Refs #36

Author: rubenvdlinde

lib/AppInfo/Application.php

@@ -29,6 +29,7 @@
 use OCA\Scholiq\Listener\CredentialIssuanceHandler;
 use OCA\Scholiq\Listener\DataExchangeRunHandler;
 use OCA\Scholiq\Listener\DeepLinkRegistrationListener;
+use OCA\Scholiq\Mcp\ScholiqToolProvider;
 use OCA\Scholiq\Listener\GradeRollupHandler;
 use OCA\Scholiq\Listener\LearningPlanEvaluationHandler;
 use OCA\OpenRegister\Event\DeepLinkRegistrationEvent;
@@ -104,6 +105,16 @@ public function register(IRegistrationContext $context): void
             listener: CredentialIssuanceHandler::class
         );
 
+        // Register ScholiqToolProvider as the MCP tool provider for the AI Chat Companion.
+        // The alias key 'OCA\OpenRegister\Mcp\IMcpToolProvider::scholiq' is the format
+        // that OR's McpToolsService enumerates to discover per-app providers.
+        // The interface ships in openregister PR #1466 (ai-chat-companion-orchestrator);
+        // until merged, Scholiq implements the stub at tests/Stubs/Mcp/IMcpToolProvider.php.
+        $context->registerServiceAlias(
+            'OCA\\OpenRegister\\Mcp\\IMcpToolProvider::scholiq',
+            ScholiqToolProvider::class
+        );
+
         // ADR-031 legitimate exception: GradeEntry.published → FinalGrade recompute bridge,
         // and AssessmentResult.graded → concept GradeEntry creation bridge.
         // Listens for OR's ObjectTransitionedEvent; the GradeRollupHandler filters to the