feat: MCP server + in-repo skills (agent-friendly platform) (#2269)

* feat(api): support global API key from config.yaml (api.global_api_key)

Accept a config-defined global API key anywhere a web-UI key is accepted
(X-API-Key / Bearer), with no login session and no DB record. Useful for
automated deployments and AI agents (HTTP API + MCP). Defaults to empty
(disabled); does not require the lbk_ prefix.

- templates/config.yaml: add api.global_api_key with security notes
- service/apikey.py: verify_api_key checks global key first (constant-time)
- docs/API_KEY_AUTH.md: document the global key + security guidance
- tests: cover global-key match, prefix-free, fallback-to-db, disabled

* feat(mcp): expose LangBot management as an MCP server at /mcp

Add an MCP (Model Context Protocol) server so external AI agents can manage a
LangBot instance. Reuses the same API-key auth as the HTTP API (including the
config.yaml global API key).

- pkg/api/mcp/server.py: FastMCP server wrapping the service layer; 21 curated
  tools across system/bots/pipelines/models/knowledge/mcp-servers/skills
- pkg/api/mcp/mount.py: ASGI dispatcher fronting Quart; authenticates /mcp
  requests with an API key, runs the streamable-HTTP session manager lifespan
- controller/main.py: serve the wrapped ASGI app via hypercorn (was run_task)
- web: new 'MCP' tab in the API integration dialog showing endpoint, auth, and
  client config; i18n for 8 locales
- tests/manual/mcp_smoke.py: e2e check (401 unauth, list tools, call tools)

Tool surface is intentionally curated (not all ~25 route groups) to keep the
agent surface small, safe, and maintainable. Extend deliberately.

* feat(skills): add in-repo skills/ as the single source of truth

Migrate the agent skills + QA/e2e test harness from the (now archived)
langbot-app/langbot-skills repo into LangBot/skills/, and add four new skills.

Migrated:
- langbot-plugin-dev, langbot-testing (e2e), langbot-env-setup,
  langbot-skills-maintenance, langbot-eba-adapter-dev
- the bin/lbs CLI (src/, test/, scripts/, schemas/, qa-agent-docs/)

New:
- langbot-dev      core backend + web development
- langbot-deploy   Docker/K8s deployment + config.yaml + global API key
- langbot-mcp-ops  operating the LangBot MCP server (/mcp)
- langbot-space-ops operating the Space marketplace MCP server

- src/cli.ts repoRoot(): recognize the skills assets root (skills.index.json +
  bin/lbs) so the CLI works when nested inside the LangBot repo
- README.md: unified skill catalog; skills.index.json regenerated

Parity with source verified: bin/lbs validate + node test suite match the
source repo (only the uncommitted .lbpkg build-artifact fixture differs).

* docs(agents): document agent-facing surfaces + API/MCP/skills sync rule

* docs(readme): add 'Built for AI Agents' section across all locales

Highlight MCP server, in-repo skills (single source of truth), AGENTS.md
sync rule, and llms.txt. Cross-link LangBot Space MCP marketplace.

* style(mcp): fix ruff format + prettier lint in MCP server and API panel

* style(web): prettier format MCP i18n locale entries

* docs(skills): note MCP instance control in dev/testing skills

All development-guidance skills now point to the LangBot instance MCP
server (/mcp) and the Space marketplace MCP server, reusing API keys.

web/src/app/home/components/api-integration-dialog/ApiIntegrationPanel.tsx

@@ -86,6 +86,11 @@ export default function ApiIntegrationPanel({
   );
   const [copiedKey, setCopiedKey] = useState<string | null>(null);
 
+  // MCP server endpoint, derived from the current origin. The backend serves
+  // the MCP server at /mcp on the same host/port as the HTTP API + web UI.
+  const mcpEndpoint =
+    typeof window !== 'undefined' ? `${window.location.origin}/mcp` : '/mcp';
+
   // 清理 body 样式，防止嵌套对话框关闭后页面无法交互
   useEffect(() => {
     if (!deleteKeyId && !deleteWebhookId) {
@@ -262,6 +267,7 @@ export default function ApiIntegrationPanel({
           <TabsList>
             <TabsTrigger value="apikeys">{t('common.apiKeys')}</TabsTrigger>
             <TabsTrigger value="webhooks">{t('common.webhooks')}</TabsTrigger>
+            <TabsTrigger value="mcp">{t('common.mcpTab')}</TabsTrigger>
           </TabsList>
           {activeTab === 'apikeys' ? (
             <Button
@@ -272,7 +278,7 @@ export default function ApiIntegrationPanel({
               <Plus className="h-4 w-4" />
               {t('common.createApiKey')}
             </Button>
-          ) : (
+          ) : activeTab === 'webhooks' ? (
             <Button
               onClick={() => setShowCreateWebhookDialog(true)}
               size="sm"
@@ -281,7 +287,7 @@ export default function ApiIntegrationPanel({
               <Plus className="h-4 w-4" />
               {t('common.createWebhook')}
             </Button>
-          )}
+          ) : null}
         </PanelToolbar>
 
         {/* API Keys Tab */}
@@ -455,6 +461,71 @@ export default function ApiIntegrationPanel({
             </div>
           )}
         </TabsContent>
+
+        {/* MCP Tab */}
+        <TabsContent
+          value="mcp"
+          className="min-h-0 flex-1 space-y-4 overflow-auto px-6 py-5"
+        >
+          <p className="text-sm text-muted-foreground">{t('common.mcpHint')}</p>
+
+          <div className="space-y-2">
+            <label className="text-sm font-medium">
+              {t('common.mcpEndpoint')}
+            </label>
+            <div className="flex items-center gap-2">
+              <code className="flex-1 truncate rounded bg-muted px-3 py-2 text-sm">
+                {mcpEndpoint}
+              </code>
+              <Button
+                variant="ghost"
+                size="sm"
+                type="button"
+                onClick={() => handleCopyKey(mcpEndpoint)}
+                title={t('common.copy')}
+              >
+                {copiedKey === mcpEndpoint ? (
+                  <Check className="h-4 w-4 text-green-600" />
+                ) : (
+                  <Copy className="h-4 w-4" />
+                )}
+              </Button>
+            </div>
+          </div>
+
+          <div className="space-y-2">
+            <label className="text-sm font-medium">
+              {t('common.mcpAuthTitle')}
+            </label>
+            <p className="text-sm text-muted-foreground">
+              {t('common.mcpAuthDesc')}
+            </p>
+            <pre className="overflow-auto rounded bg-muted px-3 py-2 text-xs">
+              {`X-API-Key: <your-api-key>
+# or
+Authorization: Bearer <your-api-key>`}
+            </pre>
+            <p className="text-sm text-muted-foreground">
+              {t('common.mcpGlobalKeyNote')}
+            </p>
+          </div>
+
+          <div className="space-y-2">
+            <label className="text-sm font-medium">
+              {t('common.mcpClientConfigTitle')}
+            </label>
+            <pre className="overflow-auto rounded bg-muted px-3 py-2 text-xs">
+              {`{
+  "mcpServers": {
+    "langbot": {
+      "url": "${mcpEndpoint}",
+      "headers": { "X-API-Key": "<your-api-key>" }
+    }
+  }
+}`}
+            </pre>
+          </div>
+        </TabsContent>
       </Tabs>
 
       {/* Create API Key Dialog */}