feat(mcp): scaffold Jira/Confluence/GitLab MCP bridge (disabled by default)

Pi has no built-in MCP; this adds a bridge extension + declarative registry.
- config/mcp.json: jira/confluence/gitlab servers, all enabled:false; URLs from
  company.json ({config:...}), tokens from env ({env:...}) — nothing hardcoded
- extensions/mcp-bridge.ts: resolves env templates, and for enabled servers
  connects via MCP SDK (dynamic import) and registers their tools; /mcp-status
  command; graceful no-op when disabled or SDK absent
- docs/mcp.md: how to enable, prerequisites (VPN, tokens, uvx/npx, SDK), security
- package.json: @modelcontextprotocol/sdk as optionalDependency; ignore package-lock

Verified offline: extension loads, /mcp-status lists 3 servers (disabled), env
resolver builds gitlab API URL from company.json gitHost + GITLAB_TOKEN. Live
connect needs VPN + a token + authorization to run the server package.

package.json

@@ -30,12 +30,15 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "*",
     "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
     "@earendil-works/pi-tui": "*",
     "typebox": "*"
   },
   "dependencies": {},
+  "optionalDependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0"
+  },
   "devDependencies": {
     "typescript": "^5"
   }