feat(mcp): add per-team server toggle

tests/Feature/Authorization/TeamAuthorizationTest.php

@@ -126,6 +126,18 @@ test('member cannot submit team settings via policy', function () {
     expect(auth()->user()->can('update', $this->team))->toBeFalse();
 });
 
+test('owner can update team MCP setting', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TeamIndex::class)
+        ->set('is_mcp_server_enabled', false)
+        ->call('submit')
+        ->assertDispatched('success');
+
+    expect($this->team->fresh()->is_mcp_server_enabled)->toBeFalse();
+});
+
 // --- Team Index Livewire: delete ---
 
 test('member cannot delete team via index', function () {

tests/Feature/Mcp/McpEndpointTest.php

@@ -90,6 +90,16 @@ test('MCP endpoint returns 404 when the instance setting is disabled', function
     $response->assertStatus(404);
 });
 
+test('MCP endpoint returns 403 when the token team has MCP disabled', function () {
+    $this->team->update(['is_mcp_server_enabled' => false]);
+    $token = $this->user->createToken('mcp-read', ['read'])->plainTextToken;
+
+    $response = mcpListTools($token);
+
+    $response->assertForbidden();
+    $response->assertJson(['message' => 'MCP server is disabled for this team.']);
+});
+
 test('MCP endpoint rejects unauthenticated requests', function () {
     $response = mcpPost(['jsonrpc' => '2.0', 'id' => 1, 'method' => 'tools/list']);
     $response->assertStatus(401);