Serve MCP and hooks with a secret through the portal tunnel

The connector now serves /mcp, its OAuth documents and /hooks/ besides
/api/v1/, refuses any dot segment (httpx resolves them, which carried
/api/v1/../../mcp onto the MCP mount), addresses calls to the hub's host,
and bridges served sockets by calling the app with a websocket scope.
A hook without a secret answers the tunnel with the 404 (or 1008) of a
wrong secret. Requests through the hub get the hub's issuer, resource and
consent page in the OAuth metadata and the 401, and the MCP host check
admits the hub while enrolled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

docs/interface/portal.md

@@ -56,6 +56,22 @@ Somebody admitted by a link gets their local account the first time they open
 the instance. Until then they are listed under **Admin → Users → Pending portal
 members**, where you can revoke the invitation.
 
+## Hooks and agents through the portal
+
+The portal also forwards a flow's hooks and the MCP endpoint, so they work
+without an inbound port:
+
+- A webhook or a served WebSocket:
+  `https://hub.fluksio.com/i/<instance-id>/hooks/<flow>/<url>/<secret>`,
+  with `wss://` for a socket.
+- An agent: `https://hub.fluksio.com/i/<instance-id>/mcp`, see
+  [Agents over MCP](../code/agents.md).
+
+Through the portal a hook needs a [secret](../reference/node-types.md#http).
+A hook without one answers only on the instance's own address; through the
+portal it gets the same 404, or closed socket, as a wrong secret. The instance
+id is the one in the address when you open the instance from the portal.
+
 ## Manage or end remote access
 
 **Settings → Remote access** shows the connection status and the latest