feat: add Do Better Norge MCP server — token system, runtime API, interactive setup page

- UserMcpTokens: per-user SHA256-hashed token mint/validate/revoke (Plus/Pro only)
- DbnMcpRuntime: 19 MCP tools (search, ask, summarize, timeline, redact, translate,
  legal_analysis, korrespond, barnevernet_analyze, advocate_brief, deep_research,
  discrepancy_find, transcribe_audio, corpus_stats, list_documents, get_document,
  citation_graph, case_workbench_plan, save_to_case)
- api/mcp/user/: session/tools/invoke HTTP endpoints with Bearer token auth
- api/mcp-tokens.php: token create/revoke/list REST API
- mcp.php: interactive setup page with token management, 5-client config tabs,
  auto-fill on token creation, tool catalog grid, privacy notice
- account.php: simplified MCP section with link to mcp.php
- nav.php: MCP nav link
- .htaccess: Authorization header passthrough, MCP route rewrite, CORS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/sql/002_user_mcp_tokens.sql

@@ -0,0 +1,20 @@
+-- Per-user Do Better Norge MCP tokens
+-- Run against dobetternorge_maindb / local DBNM database.
+
+CREATE TABLE IF NOT EXISTS user_mcp_tokens (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  user_id INT NOT NULL,
+  token_hash CHAR(64) NOT NULL,
+  token_prefix VARCHAR(32) NOT NULL,
+  name VARCHAR(100) NOT NULL DEFAULT 'Default',
+  scopes JSON NULL,
+  is_active TINYINT(1) NOT NULL DEFAULT 1,
+  last_used_at DATETIME NULL,
+  created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  revoked_at DATETIME NULL,
+  PRIMARY KEY (id),
+  KEY idx_hash (token_hash),
+  KEY idx_user_active (user_id, is_active, revoked_at),
+  CONSTRAINT fk_user_mcp_tokens_user
+    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;