GET /api/v1/crew/scorecard and MCP `scorecard` return each agent's scorecard, all time and last 30 days #3203

The scorecard (src/core/scorecard.ts) shows on /crew and in the terminal, but an agent or a script cannot read it.

Done looks like:

• [ ] GET /api/v1/crew/scorecard (admin token) answers {agents:[{username, all, recent, splits:[{model, prompt, ...}]}]} from crewScorecards and its split function. A null ratio stays null.
• [ ] A non-admin gets 403, and a request with no token gets 401.
• [ ] An MCP tool scorecard returns the same JSON. The MCP manifest lists it for admins only.
• [ ] Tests cover all three.

Files: src/http/api.ts, src/http/mcp.ts, a test.