Serve MCP and hooks with a secret through the portal tunnel

The connector now serves /mcp, its OAuth documents and /hooks/ besides
/api/v1/, refuses any dot segment (httpx resolves them, which carried
/api/v1/../../mcp onto the MCP mount), addresses calls to the hub's host,
and bridges served sockets by calling the app with a websocket scope.
A hook without a secret answers the tunnel with the 404 (or 1008) of a
wrong secret. Requests through the hub get the hub's issuer, resource and
consent page in the OAuth metadata and the 401, and the MCP host check
admits the hub while enrolled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

docs/code/agents.md

@@ -22,8 +22,12 @@ Manage registered clients under **Admin → Agents**. Revoking a client
 invalidates its access. MCP uses a separate signing key at
 `OAUTH_PRIVATE_KEY_FILE`; rotating that key invalidates all MCP tokens.
 
-MCP is not forwarded by the [portal tunnel](../interface/portal.md).
-Connect directly to the instance's API host.
+An instance connected to a [portal](../interface/portal.md) also answers
+through it, at `https://hub.fluksio.com/i/<instance-id>/mcp` (the portal's
+own `hub.` host for a custom one). The portal forwards the endpoint and its
+OAuth, and the instance checks the agent's token as it does locally. The
+consent page opens in the instance as the portal serves it, so open the
+instance from the portal first if this browser has not recently.
 
 ## Available tools