feat(mcp): module state and logs as MCP resources

[stakach]

Brings the module debugging features of the /systems/control websocket to MCP clients, using the resource templates, subscriptions and long running routes from action-controller 9.3.

• Resource templates: placeos://modules/{id}/state, placeos://modules/{id}/state/{key}, placeos://systems/{sys_id}/{module_slug}/{key} and placeos://modules/{id}/logs{?seconds,level}
• Subscriptions: the two state value templates can be subscribed to. Watchers use the websocket's redis subscriptions, so any instance can serve a client, and clients re-read the resource when notified
• GET /modules/:id/state/:key/value: returns the stored JSON as is, for MCP reads. state_lookup is unchanged
• GET /modules/:id/logs: captures a module's debug output for seconds (30s default, 36h max) at or above level, streamed over HTTP and spooled to disk for MCP clients, capped at 3 MiB with a truncation marker
• Permissions: module logs need support or admin users, or support subsystem Operate and Read (or Manage) on the module's zones. The websocket debug command now requires the same
• Requires action-controller >= 9.3.0, which no longer issues Mcp-Session-Id (spec updated)

Specs: the new and affected spec files pass locally (80 examples, 0 failures).

🤖 Generated with Claude Code