feat(mcp): Connectors — catalog + global vs per-user runtimes (§7/§14/§15)

Re-architects MCP from one owner table + agent-written registration into an
admin-curated catalog with two runtimes unioned per session, surfaced in the UI
as "Connectors" (mcp/schema stays neutral, §0.1).

Two runtimes behind one seam (§7):
- Global runtime: shared, stateless connectors (web-search, Tavily…) on the
  HOST, connected at boot from mcp_global_servers, access-filtered per user via
  mcp_global_access.
- Per-user runtime: a user's activated connectors run INSIDE their container,
  started at first login from mcp_user_servers and living until restart (§9);
  docker exec -i children die via kill_on_drop when the UserContext drops.
- McpProvider trait (mcp/provider.rs): the session round-loop never learns which
  runtime owns a server. McpManager implements it directly (inert ownerless
  bundle); UserMcpView implements global ∪ user with an accessible_global
  snapshot. Both share McpManager::connect_all; McpServerSpec +
  global_row_spec/user_row_spec turn a DB row into a connectable spec.
- mcp-client: McpServerConfig.launch_in runs a stdio command inside a container
  via docker exec -i (set at runtime, never parsed from config).

Authorization is a capability on the role, not `if role==admin` (§0.1/§14):
role_capabilities table + db/role_capabilities.rs — register_remote and
register_local_from_catalog are self-service (seeded on every new role), while
register_local_script and manage_catalog are admin-only. admin holds every
capability by construction. This removes the agent-facing register_mcp/delete_mcp
tools and the mcp kinds of list_items/toggle_item, closing the §14 RCE vector.

Schema:
- Registry: mcp_catalog (vetted templates — schema only, no live creds),
  mcp_global_servers + mcp_global_access, role_capabilities.
- Owner: mcp_user_servers (per-user activations; api_key encrypted at rest,
  catalog_name a bare TEXT snapshot, never an owner→registry FK).
- Drops the old owner table mcp_servers.

API + UI: src/frontend/api/mcp.rs (admin catalog/global/access + user
available/activate/activated, all capability-gated via require_cap);
web/components/connectors.js (<connectors-page>) renders the user view always
and the admin view for role_id === 'admin'.

Deferred: interactive per-user auth (OAuth callback / QR / SSH elicitation, §15)
— only none/api_key wired; no boot seed of catalog presets; per-(user, session)
MCP grant model still open.

crates/mcp-client/src/config.rs

@@ -16,6 +16,11 @@ pub struct McpServerConfig {
     pub url:     Option<String>,
     /// http only: API key sent as `Authorization: Bearer <key>` (supports `${VAR}` interpolation).
     pub api_key: Option<String>,
+    /// stdio only: when `Some(container)`, the command runs INSIDE that Docker
+    /// container via `docker exec -i` instead of on the host. Set at runtime by
+    /// the manager (per-user connectors, blueprint §7), never parsed from config.
+    #[serde(skip)]
+    pub launch_in: Option<String>,
 }
 
 #[derive(Debug, Deserialize, Clone)]

crates/mcp-client/src/server.rs

@@ -233,15 +233,42 @@ impl McpServer {
         let command = cfg.command.as_deref()
             .ok_or_else(|| anyhow::anyhow!("stdio server '{}' requires 'command'", cfg.name))?;
 
-        let mut cmd = Command::new(command);
-        if let Some(args) = &cfg.args {
-            cmd.args(args);
-        }
-        if let Some(env_map) = &cfg.env {
-            for (k, v) in env_map {
-                cmd.env(k, interpolate_env(v));
+        let mut cmd = match &cfg.launch_in {
+            // Host transport: spawn the command directly.
+            None => {
+                let mut c = Command::new(command);
+                if let Some(args) = &cfg.args {
+                    c.args(args);
+                }
+                if let Some(env_map) = &cfg.env {
+                    for (k, v) in env_map {
+                        c.env(k, interpolate_env(v));
+                    }
+                }
+                c
             }
-        }
+            // Container transport (per-user connectors, blueprint §7): run the
+            // command INSIDE the user's container via `docker exec -i`. stdin/
+            // stdout/stderr are proxied transparently, so the JSON-RPC read-loop,
+            // the stderr drain and elicitation write-back all work unchanged. Env
+            // is passed with `-e K=V` so it lands inside the container, not on the
+            // `docker` client. Workdir defaults to the image WORKDIR (`/root`, the
+            // bind-mounted home), so no `-w` coupling to skald-core's path layout.
+            Some(container) => {
+                let mut c = Command::new("docker");
+                c.arg("exec").arg("-i");
+                if let Some(env_map) = &cfg.env {
+                    for (k, v) in env_map {
+                        c.arg("-e").arg(format!("{k}={}", interpolate_env(v)));
+                    }
+                }
+                c.arg(container).arg(command);
+                if let Some(args) = &cfg.args {
+                    c.args(args);
+                }
+                c
+            }
+        };
         cmd.stdin(Stdio::piped())
            .stdout(Stdio::piped())
            // Capture the child's stderr instead of inheriting it: many MCP