Give bots tools and MCP servers per bot and workspace, with status and tests

- Bots and workspaces get tools and MCP servers from their settings
  pages; bots also from chips under the chat composer, removable there
- "Every bot" now gives one to every bot now and every new bot; each can
  still drop it (attach-every-bot-extensions.ts moves old installs over)
- Status lines: MCP servers record whether they connect, tools whether
  their last run worked
- Test connection in the MCP form and a Test panel in the tool form check
  the form as it is, without saving
- Hide Google sign-in on the login form

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/extensions/assert-bot-extension-manager.ts

@@ -0,0 +1,31 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import AppError from "@/src/utils/app-error";
+import grabCrewRole from "../access/grab-crew-role";
+
+type Params = {
+    user_id: number | string;
+    bot_id: number | string;
+};
+
+/**
+ * Throws unless the user manages this bot's MCP servers and tools: super
+ * admins and admins, the super admin alone for the coordinator. Returns
+ * the bot.
+ */
+export default async function assertBotExtensionManager({ user_id, bot_id }: Params) {
+    const role = await grabCrewRole({ user_id });
+    const bot = (
+        await BunSQLite.sql<{ id: number; kind: string; name: string }>({
+            sql: `SELECT id, kind, name FROM bots WHERE id = ?`,
+            values: [bot_id],
+        })
+    ).payload?.[0];
+
+    if (!bot) throw new AppError(`That bot doesn't exist.`);
+
+    if (role == "member" || (bot.kind == "coordinator" && role != "super_admin")) {
+        throw new AppError(`Only an admin can change a bot's tools.`);
+    }
+
+    return bot;
+}