fix(mcp): change enable/disable endpoints from GET to POST and fix service/app listing

- `/mcp/enable` and `/mcp/disable` now use POST (state-mutating ops)
- `ListServices` queries DB directly instead of loading all projects into memory
- `ListApplications` validates tag arg rejects empty string (not just falsy)

openapi.json

@@ -8651,7 +8651,7 @@
             }
         },
         "\/mcp\/enable": {
-            "get": {
+            "post": {
                 "summary": "Enable MCP Server",
                 "description": "Enable the MCP server endpoint at \/mcp (only with root permissions).",
                 "operationId": "enable-mcp",
@@ -8703,7 +8703,7 @@
             }
         },
         "\/mcp\/disable": {
-            "get": {
+            "post": {
                 "summary": "Disable MCP Server",
                 "description": "Disable the MCP server endpoint at \/mcp (only with root permissions).",
                 "operationId": "disable-mcp",