M6: implement ITWorx MCP Hub publication

Four read-only, service-token-protected MCP provider endpoints (operations summary, attention vehicles, vehicle details, knowledge search facade). Shared-secret auth reusing the M4 callback pattern. Service-request audit trail for every call. Extracted shared operations-summary logic out of the dashboard router to avoid duplicating retrieval logic. 66 backend tests passing, ruff clean. Verified all four endpoints and audit trail directly via curl against the live stack (no live MCP Hub instance available in this environment).

backend/app/schemas.py

@@ -178,6 +178,37 @@ class DashboardOut(BaseModel):
     recent_automation: list[AutomationRunOut]
 
 
+class OperationsSummaryOut(BaseModel):
+    tenant: str
+    metrics: DashboardMetrics
+
+
+class AttentionVehicleOut(BaseModel):
+    vehicle_ref: str
+    severity: Literal["low", "medium", "high"]
+    rule_type: str
+    summary: str
+    detected_at: datetime
+
+
+class McpVehicleDetailOut(BaseModel):
+    public_ref: str
+    make: str
+    model: str
+    model_year: int
+    location: str
+    operational_status: str
+    odometer_km: int
+    next_service_km: int
+    open_quality_issue_count: int
+    current_booking_ref: str | None
+
+
+class McpKnowledgeSearchRequest(BaseModel):
+    question: str = Field(min_length=3, max_length=1000)
+    max_sources: int = Field(default=4, ge=1, le=8)
+
+
 class AuditEventOut(BaseModel):
     id: str
     actor_type: str