Add permission-scoped MCP, readiness checks, and management UI improvements

packages/database/drizzle/0013_assistant_tokens.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "assistant_tokens" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "user_id" text NOT NULL REFERENCES "user"("id") ON DELETE CASCADE,
+  "name" text NOT NULL,
+  "token_hash" text NOT NULL UNIQUE,
+  "permissions" jsonb NOT NULL,
+  "read_only" boolean DEFAULT true NOT NULL,
+  "expires_at" timestamp with time zone NOT NULL,
+  "revoked_at" timestamp with time zone,
+  "last_used_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  "updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+CREATE INDEX "assistant_tokens_user_idx" ON "assistant_tokens" ("user_id");

packages/database/drizzle/meta/_journal.json

@@ -80,6 +80,7 @@
       "breakpoints": true
     },
     { "idx": 11, "version": "7", "when": 1789086000000, "tag": "0011_event_signs", "breakpoints": true },
-    { "idx": 12, "version": "7", "when": 1789086100000, "tag": "0012_invite_token", "breakpoints": true }
+    { "idx": 12, "version": "7", "when": 1789086100000, "tag": "0012_invite_token", "breakpoints": true },
+    { "idx": 13, "version": "7", "when": 1789164000000, "tag": "0013_assistant_tokens", "breakpoints": true }
   ]
 }