M6: implement ITWorx MCP Hub publication

Four read-only, service-token-protected MCP provider endpoints (operations summary, attention vehicles, vehicle details, knowledge search facade). Shared-secret auth reusing the M4 callback pattern. Service-request audit trail for every call. Extracted shared operations-summary logic out of the dashboard router to avoid duplicating retrieval logic. 66 backend tests passing, ruff clean. Verified all four endpoints and audit trail directly via curl against the live stack (no live MCP Hub instance available in this environment).

backend/app/api/deps.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from collections.abc import Generator
 
-from fastapi import Depends, HTTPException, Request, status
+from fastapi import Depends, Header, HTTPException, Request, status
 from sqlalchemy.orm import Session
 
 from app.core.config import get_settings
@@ -39,3 +39,14 @@ def require_operations_manager(
             status_code=status.HTTP_403_FORBIDDEN, detail="Operations Manager role required"
         )
     return user
+
+
+def require_mcp_service_token(
+    x_service_token: str = Header(..., alias="X-Service-Token"),
+    x_client_id: str = Header(default="unknown-mcp-client", alias="X-Client-Id"),
+) -> str:
+    if x_service_token != settings.mcp_hub_service_token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid service token"
+        )
+    return x_client_id