Feature/port phase 8 i18n - #181

…epositories

Ports the fork's storage schema onto main, renumbered 020-031 to sit after
upstream's 016-019. Extends InstalledServer (cloned_from, display_name_override,
default_params(+strategy), update_policy, pinned_version, latest_available_version,
version_checked_at, current_version), WorkspaceBinding (client_id, label), and
FeatureSetMember (surfaced) additively, with the SQLite repos round-tripping the
new columns. Adds embedding_repository + workspace_appearance_repository and their
core traits/entity.

Autonomous decisions:
- Kept main's exact-match WorkspaceBinding resolution (find_exact_for_roots); did NOT port i18n's longest-prefix + client-scope resolver — per orchestrator Choice A. client_id/label are persisted additively but stay global (None) today; per-client routing is a later gateway phase.
- Did not wire the new repos into ApplicationServices — i18n itself doesn't wire them there, and their consumers (gateway embedding/discovery services, workspace-appearance commands) land in later phases. Repos are crate-exported and unit-tested.
- Kept main's stronger InstalledServerRepository semantics (build_server -> Result, careful decrypt error distinction) rather than porting i18n's signatures; only the 9 new columns were added to the existing install/update CRUD. Did not add i18n's set_display_name_override/update_version_cache trait methods (later-phase consumers).
- Renamed migration 027's internal "-- Migration 023:" comment to 027 to match the renumbered filename.
- New feature-set members default surfaced=false at every construction site, matching migration 023's DEFAULT 0 and the entity constructors.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Port the web admin HTTP server stack from the i18n branch to main,
reconciled with Phase 1–2 divergences.

Autonomous decisions:
- Stubbed Phase 5/6/7 features (version probing, clone_server, display
  name override, public URL persistence, workspace icon upload via the
  `image` crate) with descriptive errors and ponytail comments — avoids
  pulling in unported dependencies while preserving the API surface.
- Replaced `WorkspaceBinding::new_scoped_multi` (Phase 6) with
  `new_multi` + manual client_id assignment using the existing API.
- Replaced `find_longest_prefix_match` (not yet added to the repo
  trait) with an inline prefix-scan over `list_for_space`.
- Used `option_env!` for MCPMUX_BUILD_* env vars so `cargo check`
  works outside CI without those variables set.
- Added admin settings keys and methods to `AppSettingsService` in
  mcpmux-core (get/set admin_enabled, admin_port, trust_cf_access,
  cf_team_domain) — minimal extension, no breaking changes.
- Added `space_repository()` accessor to `SpaceService` to avoid
  exposing the private `repository` field.
- Added `test-utils` feature flag to mcpmux-gateway Cargo.toml, used
  by the ported `#[cfg(feature = "test-utils")]` test helpers.
- Wired admin server startup into lib.rs setup closure; registered
  `reload_admin_server` Tauri command; integrated `emit_ui_channel`
  into the gateway domain-event bridge for SSE fan-in.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

- Add macos_dock.rs: set_dock_visible() wraps ActivationPolicy + dock visibility, cfg-gated #[cfg(target_os = "macos")] with a no-op stub for other platforms
- Add macos_permissions.rs: ensure_contacts_registered() triggers CNContactStore TCC prompt on first launch so McpMux appears in System Settings → Privacy & Security → Contacts; no-op on non-macOS
- Add main_window.rs: show_main_window() / hide_main_window_to_tray() helpers used by tray, deep-link focus, and close-to-tray handler
- Add Info.plist: NSContactsUsageDescription, NSCalendarsUsageDescription, NSRemindersUsageDescription, NSAppleEventsUsageDescription TCC keys
- Wire lib.rs: declare new modules, call ensure_contacts_registered() + set_dock_visible(false) in setup, use main_window helpers throughout
- Add commands/workspace_appearance.rs: list/upsert/delete workspace appearances + upload/resolve icon file commands
- Register workspace_appearance in commands/mod.rs and invoke_handler
- Add DomainEvent::WorkspaceAppearanceChanged to mcpmux-core and handle in gateway ui_events + desktop gateway bridge
- Add target-specific macOS Cargo deps: objc2, objc2-foundation, objc2-contacts, block2

Autonomous decisions:
- WorkspaceBinding.icon check in maybe_remove_orphaned_icon_file deferred to Phase 7 (field not yet on the entity); left a ponytail: comment
- DomainEvent::WorkspaceAppearanceChanged added now (minimal addition alongside Phase 2 entity) to unblock the commands compiling

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Port dev's split meta_tools module layout and supporting gateway
services from the i18n branch (supersedes upstream consolidated files
per plan Decision #6):

- Split meta_tools modules: invoke_*, search_tools(_index), list_servers,
  meta_tool_common, disclosure_*, feature_set_tools, bind_workspace,
  set_workspace_root, token_budget, approval_broker/types, diagnose_*.
- Gateway services: tool_discovery*, embedding, embedding_warmer,
  discovery_rank, prompt_discovery, resource_discovery.
- Wire embedding warmer into MCPNotifier on connect / feature-refresh.
- Add WorkspaceBinding::new_scoped_multi and a client-scoped-with-global
  -fallback find_longest_prefix_match default impl; use it in the admin
  effective-features bridge.
- Additive FeatureService grant helpers, ToolCallResult.structured_content,
  routing format helpers, session_roots search cache.
- Reconcile meta_tool_approval Tauri command with the always-approve broker.

package_version / server_version_probe deferred to Phase 6.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

- New Rust services: package_version, server_version_probe, server_clone
- New domain events: ServerVersionChecked, ServerUpdateAvailable
- InstalledServerRepository: set_display_name_override, update_version_cache
- ServerAppService: clone_server, is_clone_id_available, suggest_clone_suffix,
  list_clone_dependents, set_display_name_override, update_config extended
  with update_policy + pinned_version
- pool/transport/resolution: TransportResolutionOptions with update-policy
- New Tauri commands: get_build_info, set_server_display_name, clone_server,
  is_clone_id_available, suggest_clone_suffix, list_clone_dependents,
  update_server_package, get/update_server_update_settings,
  check_all_server_updates, check_server_version
- Frontend: CloneAccountModal, UninstallSourceWithClonesDialog,
  ServerActionMenu (clone + update actions), ServerUpdatesSection,
  ServerPendingUpdatesList, BuildStampPanel, StaleBuildBanner,
  use-build-stamp.hook, server-update-policy.helpers,
  server-pending-updates.helpers, server-display-name.helpers
- ServersPage: clone-aware uninstall, handleLockToCurrentVersion,
  handleUpdateNow, handleCheckForUpdate wired end-to-end
- build.rs: embed git SHA, branch, commit/build timestamps

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

- Add features/dashboard/ (DashboardPage, DashboardQuickLinks,
  DashboardRecentActivity, DashboardServerHealth, DashboardStatCards,
  dashboard.helpers, useDashboardData, index)
- Add /dashboard nav entry in navigation.ts + App.tsx route
- Port SourceBadge (add clonedFrom prop), source-badge.helpers.ts,
  AddServerMenu, ServerEnabledToggle, ServersCountSummary,
  ServersFiltersPopover, servers-page.helpers — hardcoded English
- Wire workspace appearances into WorkspacesPage (load/persist icons for
  unmapped roots, card + inspector live preview, upload via pickPath)
- Extend ServerIcon to resolve local:workspace-icons refs
- Add SpacePanel slide-out editor in features/spaces/
- Add AboutSection to features/settings/
- Add useMetaToolEvents, useOAuthClientEvents, useWorkspaceEvents shims
- Reconcile useServerManager to use useDomainEvents subscribe facade
- Add pendingServersFilter state/action/selector to appStore
- Add update_space Tauri command + SpaceService.update + updateSpace API
- Wire resolveInstalledDisplayName into registryStore.mergeServers

SpaceSwitcher already uses spaceAccentTint + space.icon (no change needed).

pnpm validate clean; no react-i18next in this phase.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Port react-i18next infrastructure and stringified UI from i18n branch
onto the reconciled Phases 1–7 port branch. Reconcile nav IA, meta-tools,
workspaces, registry analytics, and Phase 5–7 locale keys while keeping
port functionality intact.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>