feat: MCP server for operating Langflow via REST API (#12237)

* feat: add pure flow-builder utilities to lfx

Add flow_builder subpackage with pure functions for manipulating
flow JSON dicts — component ops, edge creation with ReactFlow
handle format, topological layout, and dynamic field detection.

* feat: add MCP server for operating Langflow via REST API

FastMCP server exposing 15 tools across auth, flow, component,
connection, and execution groups. Agents can create flows, add
and configure components, wire connections, and run flows against
a Langflow server through MCP tool calls.

* feat: add langflow-mcp-client console script entry point

* fix: use dict comprehension in setup.py to fix PERF403 lint

* fix: address PR review feedback on MCP client

- Add asyncio.Lock to prevent race condition in _client() under
  concurrent access
- Handle 204 No Content responses in delete() instead of calling
  resp.json() on empty body
- Fix weak assertion in test_default_values

* feat: auto-enable tool_mode when connecting component_as_tool

describe_component_type now shows component_as_tool as an output
for any component with tool_mode-capable outputs. When an agent
connects via component_as_tool, tool_mode is auto-enabled — no
extra step needed.

* refactor: move MCP server from langflow-base to lfx

The MCP server has no langflow dependencies — only httpx, mcp,
and lfx.graph.flow_builder. Moving it to lfx.mcp makes it usable
without installing langflow. Entry point: lfx-mcp.

* fix: isolate session state and harden MCP server

* fix: move test_flow_builder into tests/unit so CI collects coverage

* fix: add trailing slash to /api_key endpoint in MCP client login

The FastAPI endpoint redirects /api_key to /api_key/ (307) and httpx
drops the POST body on redirect, causing API key creation to fail
silently during login.

* fix: isolate session state and harden MCP server

contextvars alone lose state between stdio tool calls. Add module-level
fallback so login credentials persist across calls while still
supporting per-session isolation for SSE transport.

* fix: update test fixture to use contextvars-based server API

The mcp_client fixture was accessing mcp_server_module._client and
._registry directly, but these were replaced with contextvars
(_client_var, _shared_client, _set_client, etc.) in the server
module refactor.

* [autofix.ci] apply automated fixes

* fix: add connection type validation and fix session isolation

- add_connection() now enforces type compatibility using the Graph's
  types_compatible() when types are resolved from the flow. Explicit
  types bypass validation (caller takes responsibility).

- Session state uses only contextvars, removing _shared_client and
  _shared_registry globals that leaked between SSE sessions.

- login() wraps old client close in contextlib.suppress so a failed
  close doesn't prevent establishing a new session.

---------

Co-authored-by: Eric Hare <[email protected]>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>