Add granular MCP roles and capabilities for post access
Replaces the previous admin-only gate on MCP tools with four new WordPress roles and capability-based permission checks.
New roles:
- MCP Contributor — create posts only
- MCP Author — create, edit, and publish posts
- MCP Editor — create, edit, publish, and delete posts; can access every post, not just their own
New capabilities:
- 829_mcp_create_posts
- 829_mcp_edit_posts
- 829_mcp_publish_posts
- 829_mcp_delete_posts
- 829_mcp_manage_site
Behavior changes:
- Post endpoints (list, get, create, update, delete) now check for the specific capability required instead of manage_options.
- Non-manager roles (Contributor, Author) are scoped to only view and edit their own posts — only Editor and Site Manager can access every post.
- Site administration tools remain gated behind manage_options or the new 829_mcp_manage_site capability.
- Roles are registered on activation and kept in sync on admin_init via a versioned Roles class, so existing installs pick up role changes on update without needing reactivation.