fix(mcp): change enable/disable endpoints from GET to POST and fix service/app listing

- `/mcp/enable` and `/mcp/disable` now use POST (state-mutating ops)
- `ListServices` queries DB directly instead of loading all projects into memory
- `ListApplications` validates tag arg rejects empty string (not just falsy)

app/Http/Controllers/Api/OtherController.php

@@ -153,7 +153,7 @@ class OtherController extends Controller
         return response()->json(['message' => 'API disabled.'], 200);
     }
 
-    #[OA\Get(
+    #[OA\Post(
         summary: 'Enable MCP Server',
         description: 'Enable the MCP server endpoint at /mcp (only with root permissions).',
         path: '/mcp/enable',
@@ -209,7 +209,7 @@ class OtherController extends Controller
         return response()->json(['message' => 'MCP server enabled.'], 200);
     }
 
-    #[OA\Get(
+    #[OA\Post(
         summary: 'Disable MCP Server',
         description: 'Disable the MCP server endpoint at /mcp (only with root permissions).',
         path: '/mcp/disable',

app/Mcp/Tools/ListApplications.php

@@ -31,10 +31,13 @@ class ListApplications extends Tool
         }
 
         $tagName = $request->get('tag');
+        if ($tagName !== null && (! is_string($tagName) || trim($tagName) === '')) {
+            return Response::error('tag argument must be a non-empty string.');
+        }
         $args = $this->paginationArgs($request);
 
         $query = Application::ownedByCurrentTeamAPI($teamId)
-            ->when($tagName, function ($query, $tagName) {
+            ->when($tagName !== null, function ($query) use ($tagName) {
                 $query->whereHas('tags', fn ($q) => $q->where('name', $tagName));
             });
 

app/Mcp/Tools/ListServices.php

@@ -4,7 +4,7 @@ namespace App\Mcp\Tools;
 
 use App\Mcp\Concerns\BuildsResponse;
 use App\Mcp\Concerns\ResolvesTeam;
-use App\Models\Project;
+use App\Models\Service;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
@@ -32,17 +32,15 @@ class ListServices extends Tool
 
         $args = $this->paginationArgs($request);
 
-        $projects = Project::where('team_id', $teamId)->get();
-        $services = collect();
-        foreach ($projects as $project) {
-            $services = $services->merge($project->services()->get());
-        }
+        $query = Service::whereHas('environment.project', fn ($q) => $q->where('team_id', $teamId));
 
-        $total = $services->count();
+        $total = (clone $query)->count();
 
-        $summaries = $services
-            ->sortBy('name')
-            ->slice($args['offset'], $args['per_page'])
+        $summaries = $query
+            ->orderBy('name')
+            ->skip($args['offset'])
+            ->take($args['per_page'])
+            ->get()
             ->map(fn ($svc) => [
                 'uuid' => $svc->uuid,
                 'name' => $svc->name,