feat(mcp): align published server auth with API keys

[FinleyGe]

Summary

• Scope published MCP server management to resources created by the current member.
• Keep tools/list public while authorizing every tools/call against the effective member identity.
• Add an owner-only authProxy option with username and member ID proxy headers for both Streamable HTTP and SSE transports.
• Preserve compatibility for existing published MCP records by defaulting authProxy to false.

Test Coverage

• MCP-focused coverage: 84% (target: 80%).
• 21 focused tests cover owner/member publish permissions, proxy identity validation, departed members, conflicting proxy headers, and application read permission enforcement.
• Remaining gaps are protocol-level and UI E2E scenarios; server behavior and authorization branches are covered by unit/integration tests.

Pre-Landing Review

• No issues found.

Design Review

• No issues found.

Eval Results

• Skipped: no prompt changes.

Scope Drift

• CLEAN.

Plan Completion

• 7/7 items completed.

Verification Results

• MCP tests: 3 files, 21 tests passed.
• MCP Server TypeScript: passed (tsc --noEmit).
• MCP Server Bun build: passed.
• ESLint: passed.
• git diff --check: passed.
• Workspace tests: 6,372 passed, 35 skipped.
• App TypeScript still reports the existing missing asset @/assets/skill/runtimeUpgradeModalBg.jpg from projects/app/src/pageComponents/dashboard/skill/detail/Content.tsx; neither file is part of this PR.

Test Plan

• Verify members only see and manage their own published MCP servers.
• Verify published tools/list works without application authorization.
• Verify tools/call requires read permission for the effective member.
• Verify only team owners can enable authProxy, while members can disable an existing configuration.
• Verify username and member ID proxy headers resolve to an active member in the publishing team and reject conflicting identities.
• Verify proxy identity propagation through Streamable HTTP and SSE transports.

Documentation Generated

File	Quadrant	Description
document/content/guide/build/publish/mcp_server.mdx	How-to + Reference	Chinese setup steps, proxy headers, permission requirements, verification, and troubleshooting
document/content/guide/build/publish/mcp_server.en.mdx	How-to + Reference	English setup steps, proxy headers, permission requirements, verification, and troubleshooting

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	18.39%	1632 / 8871
🔵	Statements	18.38%	1713 / 9316
🔵	Functions	16.2%	342 / 2110
🔵	Branches	15.13%	761 / 5028

File Coverage

No changed files found.

Generated in workflow #1684 for commit 895c461 by the Vitest Coverage Report Action

[github-actions]

✅ Admin Preview Image Ready!

ghcr.io/labring/fastgpt-pr:admin_895c461efaad93676c6851b0c58a3d9dd777c879

🕒 Time: 2026-07-24 15:39:27 (UTC+8)

[github-actions]

✅ Build Successful - Preview fastgpt Image for this PR:

ghcr.io/labring/fastgpt-pr:fastgpt_895c461efaad93676c6851b0c58a3d9dd777c879

🕒 Time: 2026-07-24 15:42:43 (UTC+8)

[github-actions]

✅ Build Successful - Preview mcp_server Image for this PR:

ghcr.io/labring/fastgpt-pr:mcp_server_895c461efaad93676c6851b0c58a3d9dd777c879

🕒 Time: 2026-07-24 15:43:05 (UTC+8)

[github-actions]

✅ Docs Preview Deployed!

🔗 👀 Click here to visit preview

ghcr.io/labring/fastgpt-docs-pr:895c461efaad93676c6851b0c58a3d9dd777c879

🕒 Time: 2026-07-24 15:39:00 (UTC+8)