feat: external MCP servers as mcp connectors

[k-anshul]

Runtime support for external MCP servers, split out of #10009. Per-user OAuth follows in a separate PR on top of this one.

• New runtime/drivers/mcp driver: streamable HTTP client, headers with {{ .env.* }} templating, private networks and cross-origin redirects blocked in hosted runtimes. Sessions and tool caches are keyed by credentials, ready for per-user tokens.
• Connector security block with metrics view semantics (access, include, exclude, tool names as fields) plus agents. Without a block, only admins may use the server, since everyone acts with its credentials.
• runtime/ai: per-session tool discovery, tools exposed as mcp__<connector>__<tool>, at most 80 external tools per session, at most 25 external calls per message. External tools are never re-exported through Rill's own MCP server.
• Ping connects to the server, so rejected credentials surface as a reconcile error.
• Chat labels external tool calls as <server>: <tool>.
• Docs: the generated connector reference only. The guide page ships with OAuth.

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
• Intend to cherry-pick into the release branch
• I'm proud of this work!

---

Developed in collaboration with Claude Code