feat(mcp): add hosted site write tools

[vigneshrajsb]

Description

• Adds hosted-site write tools to the Lifecycle MCP server: create_site, update_site_content, set_site_visibility, extend_site, and delete_site. Before this, MCP could only list and read sites.
• v1 takes a single text file passed as a string (.html, .md, .markdown, .txt, .json, .csv, .xml, .svg). ZIP archives, multiple files, and binary files are rejected with an invalid_body error that says they are not supported.
• The tools sit under a new manage-hosted-sites capability. They only appear when MCP changes are allowed (allowChanges) and Sites hosting is enabled.
• delete_site and set_site_visibility require expectedAccessRevision from get_site, so the agent has to read the site before making a destructive or exposure change. Revision conflicts return a new site_changed error.
• The write tools return a compact site summary, which keeps the tool catalog under its 64 KiB limit (now about 64.7 KB, so there's little room left for future tools).

Test plan

Unit tests cover each tool, rejection of ZIP and binary files, error mapping, and catalog gating. Lint, server typecheck, and the full Jest suite pass.

To test locally with Tilt, enable Sites and turn on MCP with changes allowed, connect an MCP client to /mcp, then:

• create_site with a small HTML document returns a private site, and its URL opens for the owner.
• create_site with filename: "site.zip" or "logo.png" returns an "is not supported" error and creates no site.
• update_site_content keeps the same site id and URL and serves the new content; a stale expectedContentRevision returns site_changed.
• set_site_visibility to public makes the URL open without signing in; extend_site moves expiresAt later.
• delete_site without expectedAccessRevision is rejected; with the current revision it deletes the site and the URL stops serving.
• With MCP changes turned off, none of the write tools are listed; with Sites disabled, no site tools are listed.

Notes

• The Lifecycle UI's generated MCP capability ID type needs regenerating to include manage-hosted-sites (follow-up).