feat(mcp): add read-only MCP server for AI assistants

[gnacho]

Summary

• Add an opt-in MCP endpoint at /mcp, disabled by default with EASYZFS_MCP_ENABLED=1.
• Authenticate with existing read-only ez_... API keys via Bearer auth only; session cookies are rejected.
• Expose seven read-only tools backed by collector caches and alert state: server_status, list_pools, pool_health, list_datasets, list_snapshots, list_disks and alerts.
• Add per-IP rate limiting with EASYZFS_MCP_RATE_PER_MIN and document OpenCode configuration in EN/ES.

Security

• MCP tools never execute ZFS commands and never mutate state.
• The endpoint is mounted outside the session middleware and is fail-closed without the API key store.
• server_status avoids exposing internal paths such as the SQLite DB path.

Verification

• go vet ./...
• go test ./internal/...
• go test -race ./internal/...
• Static CGO_ENABLED=0 build
• Live mock-instance smoke test: tools/list returned all 7 tools; authenticated tool calls returned pool/status data; missing or cookie-based auth returned 401.

Closes #146