fix: sync remote tool metadata with overwrite confirmation

[chenyme]

Summary

修复 MCP 工具同步时名称和描述未随远端更新的问题。

• 未经管理员修改的工具会同步最新名称、描述和输入 Schema。
• 管理员修改过的名称或描述默认保留。
• 同步前提供“保留修改”与“覆盖修改”选项。
• 覆盖同步后恢复为远端管理状态。
• 兼容升级前无法判断元数据来源的历史工具，避免静默覆盖。
• 同步更新 Swagger 和 TypeScript API Contract。

Fixes #526

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• pnpm --filter @deeix/web lint
• pnpm --filter @deeix/web typecheck
• pnpm api:check
• cd backend && go test ./...
• pnpm build
• git diff --check

Screenshots, API examples, or logs

管理端同步存在自定义或升级前工具元数据的 MCP 服务时，会显示确认对话框：

• 保留修改并同步
• 覆盖修改并同步

Configuration, migration, and compatibility notes

• mcp_tools 新增可空的 metadata_customized 状态列，由现有 Schema 初始化流程自动迁移。
• 新同步的工具默认为远端管理状态。
• 升级前工具保持待确认状态，首次同步不会静默覆盖现有名称和描述。
• 无需手动执行数据库迁移。
• 同步接口新增可选查询参数 overwrite_customized_metadata，默认值为 false。
• Swagger 和 packages/api-contract 生成类型已同步更新。

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.