feat(server): integrate MCP queries and investigation messaging

Add project-bound OAuth MCP queries and controlled analysis with scoped evidence,
limits, timeouts and a nearby-model spatial query using EPSG:4326 inputs.
Default nearby searches to 200 meters and five results.

Integrate investigation messaging/presentation, health/readiness and typed history;
remove duplicate web search and fix online simulation and compressed baseline writes.
Include project migrations 023-025; keep local credentials and demo seeding excluded.

Validation: 319 focused pytest checks; real PostGIS temporary-table regression;
read-only Jinqian bridge radius comparison; cross-language MCP discovery/calls.

.env.example

@@ -29,6 +29,8 @@ TIMESCALEDB_DB_HOST="localhost"
 TIMESCALEDB_DB_PORT="5433"
 TIMESCALEDB_DB_USER="tjwater"
 TIMESCALEDB_DB_PASSWORD="password"
+# 实时快照替换事务的解压预算；仅事务内生效，禁止0（无限制）。
+TIMESCALEDB_REALTIME_MAX_DECOMPRESSED_TUPLES=1000000
 
 # ============================================
 # 元数据数据库配置 (Metadata DB)
@@ -96,15 +98,30 @@ OPERATIONAL_DATA_DELEGATION_BEARER=""
 
 
 # ============================================
-# Bocha Web Search API
+# Tianditu shared API key and service URLs
 # ============================================
-BOCHA_API_KEY="sk-your-bocha-api-key"
-BOCHA_WEB_SEARCH_URL="https://api.bochaai.com/v1/web-search"
-BOCHA_WEB_SEARCH_TIMEOUT_SECONDS=30
-
-# ============================================
-# Tianditu Geocoding API
-# ============================================
-TIANDITU_GEOCODER_TOKEN="your-tianditu-geocoder-token"
+TIANDITU_TOKEN="your-tianditu-token"
 TIANDITU_GEOCODER_URL="https://api.tianditu.gov.cn/geocoder"
 TIANDITU_GEOCODER_TIMEOUT_SECONDS=30
+
+# 地名搜索与地理编码共用 TIANDITU_TOKEN；也可沿用 TJWATER_TIANDITU_TOKEN。
+TIANDITU_SEARCH_URL="https://api.tianditu.gov.cn/v2/search"
+TIANDITU_SEARCH_TIMEOUT_SECONDS=15
+
+# MCP query resource, off until OAuth and every project BizDB are provisioned.
+# 仅 ENVIRONMENT=development 时覆盖 worker 取令牌地址；留空沿用 OPERATIONAL_WORKER_TOKEN_URL。
+OPERATIONAL_WORKER_DEV_TOKEN_URL=
+TJWATER_MCP_ENABLED=false
+TJWATER_MCP_ISSUER_URI=
+# 仅 ENVIRONMENT=development，可填写与 issuer 完全相同的内网 HTTP IPv4 issuer。
+# 正式环境必须留空；此例外不放行远程 HTTP MCP resource。
+TJWATER_MCP_DEV_HTTP_ISSUER_URI=
+TJWATER_MCP_RESOURCE_URI=
+TJWATER_MCP_AUDIENCE=tjwater-mcp
+TJWATER_MCP_HOST_CLIENT_ID=tjwater-agent-mcp
+TJWATER_MCP_ALLOWED_HOSTS=["localhost:*","127.0.0.1:*"]
+TJWATER_MCP_ALLOWED_ORIGINS=[]
+# 普通查询预算；计算工具由 Agent 用 timeout_seconds 按次指定（默认120秒）。
+TJWATER_MCP_QUERY_TIMEOUT_SECONDS=30
+# 计算等待上限，默认1小时；管理员可配置120至86400秒，实际上限通过 tools/list 发布。
+TJWATER_MCP_MAX_CALCULATION_TIMEOUT_SECONDS=3600