feat(mcp): local MCP server exposes voicebox.* tools to AI agents

Mounts FastMCP at /mcp (Streamable HTTP) so Claude Code, Cursor,
Windsurf, and the VS Code MCP extensions can call voicebox.speak,
voicebox.transcribe, voicebox.list_captures, and voicebox.list_profiles
against the running Voicebox server.

Backend
- new backend/mcp_server package (tools, middleware, profile resolve,
  pub/sub events); named mcp_server to avoid shadowing the installed mcp
  PyPI package FastMCP imports internally
- app.py migrated from @app.on_event to lifespan= so FastMCP's session
  manager cohabits with Voicebox's startup/shutdown
- new MCPClientBinding table + /mcp/bindings CRUD; ClientIdMiddleware
  reads X-Voicebox-Client-Id into a ContextVar and stamps last_seen_at
- profile resolution precedence: explicit -> per-client binding ->
  capture_settings.default_playback_voice_id
- POST /speak REST wrapper for non-MCP callers (shell, ACP, A2A)
- GET /events/speak SSE broadcasts speak-start / speak-end so the pill
  surfaces agent-initiated speech
- backend/mcp_shim proxy (plain httpx) for stdio-only MCP clients
- PyInstaller spec updates + new --shim build target (~18 MB)

Frontend
- Settings -> MCP page with HTTP / stdio / claude-mcp-add copy snippets,
  default voice picker, per-client bindings table, connection status
- useMCPBindings, useSpeakEvents hooks
- CapturePill gains 'speaking' state; DictateWindow subscribes to SSE
  and emits dictate:show so the Rust side surfaces the pill window

Native
- tauri.conf.json externalBin now includes voicebox-mcp
- show_dictate_window helper + dictate:show listener in main.rs
- (also in this commit: InputMonitoringGate UX, hotkey_monitor tweaks,
  landing footer/navbar updates, new overview docs for captures /
  dictation / mcp-server / voice-personalities)

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

backend/mcp_server/server.py

@@ -0,0 +1,79 @@
+"""Construct the FastMCP server and mount it on the FastAPI app.
+
+The MCP endpoint lives at ``/mcp`` (Streamable HTTP transport). Modern MCP
+clients (Claude Code, Cursor, Windsurf, VS Code MCP extensions) connect
+directly via URL; older stdio-only clients use the ``voicebox-mcp`` shim
+binary bundled with the desktop app.
+"""
+
+from __future__ import annotations
+
+import logging
+from contextlib import AsyncExitStack, asynccontextmanager
+from typing import Callable
+
+from fastapi import FastAPI
+from fastmcp import FastMCP
+
+from .context import ClientIdMiddleware
+from .tools import register_tools
+
+
+logger = logging.getLogger(__name__)
+
+
+def build_mcp_server() -> FastMCP:
+    """Create the FastMCP instance with Voicebox tools registered."""
+    mcp = FastMCP(
+        name="voicebox",
+        instructions=(
+            "Voicebox is a local voice I/O layer. Use `voicebox.speak` to "
+            "play text in a voice profile, `voicebox.transcribe` for "
+            "audio→text, and the `list_*` tools to discover profiles and "
+            "captures."
+        ),
+    )
+    register_tools(mcp)
+    return mcp
+
+
+def mount_into(
+    app: FastAPI,
+    *,
+    extra_startup: Callable[[], None] | None = None,
+) -> None:
+    """Attach the MCP app to ``app`` at ``/mcp`` and install the client-id middleware.
+
+    ``extra_startup`` — if provided, runs during the FastAPI lifespan. This
+    is the hook that lets ``app.py`` keep its existing startup/shutdown
+    bodies while also driving FastMCP's session manager.
+    """
+    mcp = build_mcp_server()
+    mcp_app = mcp.http_app(path="/", transport="http")
+
+    # ClientIdMiddleware must run before FastMCP so the ContextVar is set
+    # by the time tool handlers execute. Starlette composes middlewares
+    # outermost-first, so adding here on the parent app is correct.
+    app.add_middleware(ClientIdMiddleware)
+    app.mount("/mcp", mcp_app)
+    app.state.mcp_lifespan = mcp_app.router.lifespan_context
+    logger.info("MCP: mounted at /mcp (FastMCP %s)", getattr(mcp, "version", ""))
+
+
+def compose_lifespan(*lifespans):
+    """Combine multiple async context managers into a single FastAPI lifespan.
+
+    Used by ``create_app`` to run the existing Voicebox startup/shutdown
+    together with FastMCP's session manager (which MUST run in the
+    ASGI lifespan for Streamable HTTP to work).
+    """
+
+    @asynccontextmanager
+    async def _combined(app):
+        async with AsyncExitStack() as stack:
+            for cm_factory in lifespans:
+                cm = cm_factory(app) if callable(cm_factory) else cm_factory
+                await stack.enter_async_context(cm)
+            yield
+
+    return _combined