MCP `origin_apps`: list, add and remove the caller's origin OAuth apps, never reading a secret back #4813

Intent: a person connecting their own GitHub or GitLab OAuth app, so that origins can be connected, does it from their harness, and a client secret is never read back.

Done:

• [ ] src/http/mcp.ts has an origin_apps tool, placed right after make_it_yours, taking action (list | add | remove), id and the fields POST /api/v1/user/origin-apps takes. It calls what GET/POST /api/v1/user/origin-apps and DELETE /api/v1/user/origin-apps/:id call, for the caller only
• [ ] no answer or error carries a client secret
• [ ] docs/MCP.md has its row beside make_it_yours
• [ ] test/mcp-origin-apps.test.ts: a person adds, lists and removes an app, and no answer contains the secret; another person cannot remove it; a missing field is refused with the API's error

Risks: test/mcp-size.test.ts holds tools/list under a 37,000-byte headroom, so keep the description to one short sentence. Other MCP tools are being added in parallel, so put this one exactly where named. Do not change the API routes.