feat(platform): token management API + MCP setup + external agent guide
1. Token Management API (closes production gap):
- GET /workspaces/:id/tokens — list tokens (prefix + metadata, never plaintext)
- POST /workspaces/:id/tokens — create new token (plaintext returned once)
- DELETE /workspaces/:id/tokens/:tokenId — revoke specific token
- Behind WorkspaceAuth middleware (need existing token to manage tokens)
- Tests skip gracefully when no DB available
2. MCP Server Setup:
- Fix .mcp.json to use npx @molecule-ai/mcp-server (was referencing
non-existent local ./mcp-server/dist/index.js)
- Add comprehensive tool→API mapping doc (87 tools across 15 categories)
3. External Agent Registration Guide:
- Step-by-step: create workspace, register, heartbeat, A2A messaging
- Python (Flask) and Node.js (Express) complete working examples
- Communication rules, lifecycle, security, troubleshooting
4. Token Management Guide:
- Bootstrap flow, rotation procedure, security properties
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3892e4dee1