MCP: per-database endpoint/config scoping #4868

Part of #4859.

Motivation

allowedUsers (and all other permission flags) are server-global today (MCPConfiguration is a single server-wide instance). Multi-tenant agent deployments need to bind an MCP surface to one database with its own permission set. Justification: #3 different permissioning.

Proposed design (conservative v1 scope)

• Extend MCPConfiguration with an optional per-database override map (e.g. databases: {"<dbName>": {allowedUsers, allowReads, allowInsert, ...}}), consulted by tool execute() methods alongside MCPToolUtils.resolveDatabase(server, user, dbName).
• Do not attempt new HTTP routing (e.g. /mcp/{database}) in v1 — flag that as a larger architectural change needing its own design pass; note it explicitly as a candidate follow-up, not silently dropped.
• This issue carries the most architectural uncertainty in the set — recommend a short design note/spike before implementation rather than starting directly from this issue body.

Acceptance criteria

• Per-database override resolved correctly when present; falls back to server-global config when absent (backward-compatible).
• Override respected by every existing and new tool (audit all tool permission-check call sites, not just new ones).
• Tests cover: no override (current behavior), override present (stricter), override present (more permissive than global — decide and document whether this is allowed or capped by the global config as a ceiling).
• Docs describe the override format and multi-tenant use case; explicitly note HTTP per-database routing is out of scope for this issue.

Files to touch

MCPConfiguration.java, MCPToolUtils.java, every tool class's permission-check call site, tests, docs.

Dependencies

None (independent), but highest uncertainty — recommend last in sequence.

Effort estimate

L — audit surface across all tools, open design question on override-vs-ceiling semantics, no routing changes included.