test(integration): un-skip mcp-protocol (closes #3317)

[bokelley]

Summary

Closes #3317. Last item in the #3289 umbrella.

The triage agent's directional pick (Option B — force `Accept: application/json`) didn't survive contact: the MCP StreamableHTTP transport returns 406 Not Acceptable when the Accept header doesn't include `text/event-stream`. Switched to Option A (parse the SSE framing back into JSON), which is also more accurate to how real MCP clients negotiate.

Three tests had to move off JSON-RPC `error` envelopes too — the MCP spec carries tool-execution errors in `result.isError` + content, not in the `error` channel (which is reserved for protocol-layer failures like unknown methods). Realigned to the spec-correct shape.

What's in the PR

• `callMcp` SSE-aware helper — sets `Accept: application/json, text/event-stream`, strips the `event: message\ndata: {...}` framing back to JSON, attaches it as `response.body` so existing assertions stay readable.
• `vi.mock('express-rate-limit')` — `/mcp` has its own inline `mcpRateLimiter` (`max: 10/min`) that isn't exported from `middleware/rate-limit.ts`. Stubbing the underlying package as passthrough disables every rate limiter for the test, including the inline one. Without this, 22 sequential calls hit the limit and start coming back as `-32000 Rate limit exceeded`.
• Three tests realigned to spec shape — `get_agent` for a missing URL and `tools/call` for an unknown tool name return `result` (not `error`); structured content now asserts `result` shape and absence of `error`.
• `toHaveLength(32)` → `length > 0` — tool registry grows; presence checks for specific tools live in their own tests.
• `server['app']` → `server.app` — drops the private-property bracket-escape.
• `afterAll(() => server.stop())` — closes the open HTTP handle the previous file leaked.

Test plan

• CI `Server integration tests` job goes green.
• `DATABASE_URL=... npm run test:server-integration` locally → mcp-protocol shows 21 passed.

Combined with PR #3326, #3327, #3328, #3333 (all merged or pending), this completes the #3289 umbrella.

🤖 Generated with Claude Code