feat(agent): unify MCP tools and adopt Responses delivery

Move project and host queries into native MCP with host-owned OAuth/context,
while retaining memory, skills, actions and publication plugins. Add nearby-model
queries and explicit chat/task/learning model defaults.

Adopt Responses HTTP/SSE and native steer/queue inbox delivery, preserving scoped
session ownership, pending input edits and investigation communication.

Disable local-provider discovery: Server /health allowed native vLLM to probe
/v1/models on port 8000. A native before/after regression prevents recurrence.

Validation: 170 focused Bun tests; service/plugin typechecks; native discovery,
provider-discovery and input-inbox smoke checks; no paid model inference.

.env.example

@@ -1,30 +1,42 @@
-PORT=8787
+# 复制为 .local.env 后填写；密钥勿提交。
+
+# 服务
+NODE_ENV=development
 HOST=0.0.0.0
+PORT=8787
 LOG_LEVEL=info
-TJWATER_SERVER_TIMEOUT_MS=10000
 TJWATER_SERVER_BASE_URL=http://127.0.0.1:8000
+TJWATER_SERVER_TIMEOUT_MS=10000
 
-CONVERSATION_WORKSPACE_ROOT=./.agent-workspaces
-SANDBOX_MAX_OUTPUT_BYTES=1048576
+# MCP
+# 内网 HTTP 仅限 development，DEV_HTTP_ISSUER_URI 需与 issuer 相同。
+TJWATER_MCP_ENABLED=false
+TJWATER_MCP_ISSUER_URI=
+TJWATER_MCP_DEV_HTTP_ISSUER_URI=
+TJWATER_MCP_RESOURCE_URI=http://127.0.0.1:8000/mcp
+TJWATER_MCP_AUDIENCE=tjwater-mcp
+TJWATER_MCP_CLIENT_ID=agent-mcp
+TJWATER_MCP_CLIENT_SECRET=''
 
+# OpenCode
+# client 模式另填 OPENCODE_CLIENT_BASE_URL、OPENCODE_CLIENT_PASSWORD、AGENT_INTERNAL_TOKEN。
 OPENCODE_MODE=embedded
-# OpenCode 2 CLI 路径或命令；默认 opencode2。
 OPENCODE_COMMAND=opencode2
-# client 模式连接私有 V2 server 时，填写其 server password（不要提交实际值）。
-# OPENCODE_CLIENT_PASSWORD=
-# 模型、provider、默认聊天/后台/学习模型统一在 agent-models.json 配置。
-# 可选：使用独立的本地配置文件，修改后重启 Agent 和外部 OpenCode。
-# AGENT_MODEL_CONFIG_PATH=./agent-models.local.json
-# API key 仅在本地或部署环境填写，不提交实际值。
-# 当前配置未启用 DeepSeek；重新配置该 provider 时再填写。
-# DEEPSEEK_API_KEY=
-WATERNETWORK_API_KEY=
 OPENCODE_HOSTNAME=127.0.0.1
 OPENCODE_PORT=0
-# client 模式必须在 Agent 与外部 OpenCode 进程配置同一个高熵值；embedded 模式可留空。
-# AGENT_INTERNAL_TOKEN=replace-with-a-random-server-only-secret
+OPENCODE_TIMEOUT_MS=5000
 
+# 模型密钥
+# provider 与模型在 agent-models.json 配置。
+# AGENT_MODEL_CONFIG_PATH=./agent-models.local.json
+# DEEPSEEK_API_KEY=
+WATERNETWORK_API_KEY=
+
+# 会话与沙箱
+CONVERSATION_WORKSPACE_ROOT=./data/session-workspaces
+SANDBOX_MAX_OUTPUT_BYTES=1048576
+
+# 本地调试
 AGENT_LOCAL_USER_ID=local-user
-# 必须填写 Server /api/v1/projects 返回的项目 UUID。
 AGENT_LOCAL_PROJECT_ID=00000000-0000-0000-0000-000000000000
 AGENT_LOCAL_NETWORK=local-network