feat: add write-capable MCP tools

[andrewzolotukhin]

Original request

Implement the planned PR to make the xpenser MCP endpoint write-capable so agents can manage vendors, categories, and transactions instead of only reading data.

What changed

• Expanded the MCP tool registry from read-only tools to a read/write surface for categories, vendors, vendor candidate discovery, and transactions.
• Reused the existing application services for category create/update/delete/move-delete, vendor list/get/search/details/create/update/enrich, and transaction create/update/delete/list.
• Added MCP input schemas, date/default normalization, tool annotations for read-only/write/destructive/open-world behavior, structured mutation responses, and expected domain-error mapping to MCP invalid params.
• Wired MCP server construction with config and knex so vendor enrichment, currency conversion, and transaction listing match the HTTP API behavior.
• Updated README, security baseline, and landing copy to remove read-only MCP language.
• Expanded MCP unit coverage for tool names/annotations, read delegation, write delegation, structured delete results, date normalization, and expected error mapping.

Reasoning

This keeps MCP as another authenticated entry point over the same business logic already used by the HTTP API rather than introducing a parallel write path. Current API keys remain the authorization boundary, matching the existing external API model. Vendor deletion is not included because the current API and application services do not define vendor deletion semantics.

Screenshots / preview evidence

Screenshots are not applicable because this is a non-visual API/MCP endpoint change.

Preview QA passed against https://xpenser-pr-029.cleverbrush.com: logged in with the seeded account, created an API key, connected through Streamable HTTP MCP, confirmed 19 tools, created a category, created a vendor, created a transaction, updated the transaction amount to 23.45, deleted the transaction, deleted the temporary category, and revoked the temporary API key.

Validation

• npm run lint passed locally.
• npm run typecheck passed locally.
• npm test passed locally: 58 files, 336 tests.
• Focused MCP suite passed locally: npm test -- apps/api/src/mcp/tools.test.ts.
• GitHub Lint and test passed.
• GitHub Deploy PR environment passed.
• GitHub Playwright e2e passed.
• SigNoz xpenser-api-pr-29 traces/logs/operation telemetry checked after preview QA: xpenserMcp, category, vendor, and transaction operations were present; top operations reported errorCount: 0; error-only trace and ERROR-log queries returned no rows.