feat(mcp): P0 只读 MCP tool runtime + opsxdb-mcp stdio

- aitools 共用 runtime：list/describe/schema/query/redis（纯只读，无写确认）
- 白名单 ~/.opsxdb/mcp.json；审计 mcp-audit.jsonl；复用 danger.go
- 桌面 connections 双写 ~/.opsxdb/connections.json（ox1. 解码）
- Cursor 配置示例与任务书验收勾选更新；写操作与 Agent UI 留 P1

.gitignore

@@ -14,25 +14,30 @@ coverage/
 .turbo/
 .idea/
 .vscode/
-apps/server/opsxapi
-apps/server/server
-apps/desktop/src-tauri/gen/
+server/opsxapi
+server/server
+src-tauri/gen/
 *.exe
 *.dylib
 *.so
 Cargo.lock
-!apps/desktop/src-tauri/Cargo.lock
+!src-tauri/Cargo.lock
 
 # local review / sync artifacts
 .ui-review-*/
 _refs/
 _sync/
 opsxdb-refs.tar.gz
-apps/server/bin/
+server/bin/
 logs/
-apps/desktop/src-tauri/binaries/opsxdb-server-*
+src-tauri/binaries/opsxdb-server-*
 *.bak
 
 # review artifacts / test outputs
 .ui-review/
 tests/accept-result.txt
+
+*.tsbuildinfo
+
+# MCP / local build artifacts
+/bin/