feat: MCP connect surface on Integrations page — show-once key + skill download (ADR-0036 Phase 2b)

[xuyushun441-sys]

Context

ADR-0036 Phase 2b — the surfacing layer that turns "your app is an MCP server" into a one-click connect experience. Framework side is ready/landing:

• discovery advertises mcp when enabled (framework #1626): GET /api/v1/discovery → routes.mcp present iff OS_MCP_SERVER_ENABLED.
• generic Skill generator renderSkillMarkdown({ mcpUrl, envName }) in @objectstack/mcp (#1628).
• the Integrations page already exists (objectui feat(console): Integrations & APIs page — surface every app as a REST API (ADR-0036 Phase 1b) #1540).

Blocked on: objectstack-ai/framework#1629 (key-generation endpoint) — needed to show a real show-once key.

Goal

On the Integrations page, add a "Connect an AI agent (MCP)" section so a user can connect their environment to Claude / Cursor / Codex / any MCP+Skills client in one flow.

What to build

1. MCP endpoint card — show the env's MCP URL from discovery.mcp (only when present; if absent, show "MCP not enabled for this environment" with a hint that it's opt-in via OS_MCP_SERVER_ENABLED).
2. Generate key (show-once) — button → POST /api/v1/keys (framework#1629) → modal showing the raw key ONCE with copy + an explicit "you won't see this again" warning. Never persist/redisplay the raw key client-side beyond the modal.
3. Download Skill — a "Download skill (works with any agent)" action that produces the env's SKILL.md via renderSkillMarkdown({ mcpUrl, envName }) (either call a framework endpoint that serves it, or import the helper). Explain it's the portable, cross-agent artifact.
4. Connect instructions — concise: set header x-api-key: <key> on a remote MCP server at the shown URL; note Bearer is session auth.

Notes / guardrails

• One connection per environment, not per app (apps are discovered live via the MCP tools). Don't render per-app connect buttons.
• Don't hand-build vendor-specific config JSON as the primary artifact; the Skill + URL + key is the cross-agent path. A one-click "Add to Claude/Cursor" deeplink is a nice-to-have on top.
• Keep the existing Phase 1b Integrations content; this is an additive section.

Acceptance criteria

• Section renders MCP URL from discovery; generate-key show-once modal works against framework#1629; skill download produces a valid SKILL.md with the env URL slotted; instructions accurate.