refactor(mcp): guard the app list both pi write paths walk

Review follow-up to the pi local-MCP source.

`mcp_upsert_local_server` and `mcp_remove_server` each kept their own
hand-typed copy of every `McpAppType`. Both mean "these agents and NO
others" — the first REMOVES the server from every app it lists but was
not handed, the second deletes it from every app it lists — so an app
missing from either fails silently: a stale entry survives the save and
the next scan reports it as a live assignment, and an "uninstalled"
server comes back on the next refresh. Adding `Pi` had to land in both,
with nothing checking that it did.

Fold them into one `ALL_MCP_APPS` (same contents, same order) and pin it
with `all_mcp_apps_is_exhaustive`: an arm-less `match` stops the build
when a variant is added, plus a no-duplicates check and the invariant
that every source `local_mcp_readers` can attribute a server to is also
one these paths can write. Also completes the wire-name test, which was
missing `Antigravity`.

Docs, no behavior change: give the pi block the section banner every
other agent block in this file has (path, schema, why it is scan-only,
why `read_servers_for_agent_type(Pi)` must stay empty, and the shared-id
merge caveat), and restore the rationale the settings-page comment
rewrite dropped — a scan warning can name pi, which is what
`SCAN_ONLY_APP_LABELS` is for.