Add stop_server + status MCP tools; TDQS-grade tool descriptions

[cuihtlauac]

Why

Glama scores this server 3.9/5.0 on TDQS. The per-tool feedback: update_host behavior 2/5 (update semantics undocumented), start_server behavior 3/5 (blocking/readiness unstated), execute missing timeout/return/error info — and server coherence 3/5: "no stop/status tool… no way to read hosts even though update_host implies a host registry". This PR addresses all of it: the three descriptions are rewritten and stop_server / status become real tools. stop_server also serves the session-handoff workflow (shut the approval daemon down at wrap-up).

Protocol: control actions

New optional action field on the wire request: exec (default), stop, ping. Compatibility rests on two existing facts: every Response is version-stamped, and validation rejects an empty pipeline before any prompt.

• New clients send control requests with "pipeline": [] — an old daemon parses them (no deny_unknown_fields), rejects at validate without prompting the human, and its error reply still reveals its version, which the new tools use for a friendly "predates this feature" message.
• Exec requests from new clients omit action entirely, staying byte-identical to the pre-1.1 wire format; old clients never send it and default to exec.
• Control actions pass every gate an exec does (peer-uid, field sanitization, freshness, replay), so a captured stop request cannot be replayed later.

Daemon

• stop: prints a dim notice on the TTY ("sudo-proxy stopped by ") — no approval prompt, since a same-UID peer can already SIGTERM the daemon, so a gate would add friction without a security boundary — replies ok, then shuts the accept loop down cleanly and removes the socket. The terminal window (and SSH tunnel, remotely) closes with it.
• ping: replies ok/"pong" without prompting.
• The shutdown flag becomes an Arc<AtomicBool> so handler threads can set it; main now cleans up the socket on clean return.

MCP tools

• stop_server { host? } — "not running" is a non-error result; on success polls briefly for the socket to disappear and removes a leftover tunnel socket; against a pre-1.1 daemon returns an error asking for a manual q/Ctrl+C.
• status { host? } — with no args, checks the local daemon plus every registry host; per host reports socket presence, readiness, live daemon version via ping, and registry metadata. Read-only except refreshing the hosts.json last-connected/version cache.
• All three existing descriptions rewritten to document blocking behavior, timeout default/clamp, return format, denial/timeout errors, partial-update semantics, and auto-registration (the TDQS gaps).

Tests & docs

• Protocol serde/validate tests (old-JSON compat both directions, empty-pipeline rules, control-field sanitization).
• New server-level integration tests: stop shuts run down without a prompt; ping answers without a prompt and the daemon keeps serving; a stale stop is rejected and the daemon survives.
• Introspection test now expects five tools; docs/mcp.md, docs/protocol.md, README updated.
• Version 1.0.0 → 1.1.0 (tag to be applied on merge per CLAUDE.md).

Verified live: full status → stop_server → status cycle against a 1.1.0 daemon (clean exit, socket removed), and against a real 0.12.0 daemon — status reports "running (sudo-proxy 0.12.0, predates ping)", stop_server returns the manual-stop message, old daemon unaffected, no prompt ever shown.

Note: burst_connections_above_cap_get_busy_response is flaky when run standalone in --release on unmodified main as well — pre-existing, unrelated.

🤖 Generated with Claude Code