feat(desktop): add local agent MCP access substrate

[huntharo]

Summary

I added the first implementation slice for local-agent MCP access to PwrSnap.

This PR includes:

• A local-agent grant model with scoped capabilities in Settings and token hashes stored through the existing secret store.
• Command-bus support for carrying local-agent identity/capabilities alongside existing IPC/RPC/MCP principals.
• Settings commands and a Local Agents settings page for listing/revoking grants and highlighting sensitive capabilities.
• A loopback MCP Streamable HTTP server using @modelcontextprotocol/sdk, with bearer grant authentication and per-tool capability checks.
• Initial MCP tool/resource registry scaffolding with tests for auth refusal, tool annotations, capability denial, and shutdown.
• The plan doc for the full library/media/edit/sizzle rollout.

PwrSnap already had MCP-shaped internal plumbing: Codex/ACP tool allowlists dispatch through the command bus with principal: "mcp", and the command bus was documented as transport-ready. This PR adds the missing external paired-client MCP listener plus local-agent grant/auth boundary.

Screenshots

No screenshots attached. The visible UI change is a Settings → Local Agents page, but this slice is primarily main-process substrate and transport wiring.

Screen recording

No screen recording attached.

How was this tested?

I verified the rebased branch with:

• source ~/.nvm/nvm.sh && nvm use >/dev/null && pnpm --filter @pwrsnap/desktop exec vitest run src/main/local-agents/__tests__/local-agent-grants.test.ts src/main/local-agents/__tests__/mcp-server.test.ts src/main/handlers/__tests__/settings-handlers.test.ts src/renderer/src/features/settings/__tests__/LocalAgentsPage.test.tsx
• source ~/.nvm/nvm.sh && nvm use >/dev/null && pnpm --filter @pwrsnap/desktop typecheck

I also verified the branch was rebased on origin/main and all branch commits are SSH-signed.

Checklist

• PR title follows type(scope): description
• Tests added or updated (or explained why this is docs-only)
• Relevant checks pass locally (pnpm test, pnpm typecheck)
• THIRD_PARTY_LICENSES regenerated if dependencies changed (pnpm licenses:generate)
• Screenshot or recording attached for user-facing changes