feat(mcp): add config/CLI/TUI/migration surface for image passthrough

[bug-ops]

Summary

Completes the P3 phase of the MCP image passthrough feature (spec-072), building on the
merged P2 MediaSanitizer work (#6331/#6240):

• --init: MCP remote-server wizard now asks "Enable image passthrough for this server?"
  (default No); Sandboxed-trust servers skip the prompt since passthrough is always
  hard-blocked for them at runtime regardless of the flag.
• --migrate-config: new step 89 backfills media_passthrough = false on existing
  [[mcp.servers]] entries and appends a commented [mcp.media] advisory block for
  configs written before this feature existed.
• TUI/CLI status indicators (mandatory per CLAUDE.md TUI Rules): a "Decoding MCP image…" spinner during MediaSanitizer::sanitize_image's decode, and a source-labeled
  "Image attached from mcp:<server> (<n>)" status when validated images are attached to
  the outgoing LLM request.
• --no-mcp-media: an opt-in global CLI kill-switch for incident response, with full
  parity across the CLI/TUI runner, daemon, and both ACP entry points (threaded through
  AppBuilder::new, mirroring the existing safe_mode pattern).

Review notes

• Reduced new-feature chain (no architect — scope was fully concrete from the merged P2
  work; no perf/security validators — no hot path or new security-critical logic).
• impl-critic's first pass found a significant gap: the initially-proposed --no-mcp-media
  fix path was broken (config.cli.no_mcp_media had no populator), so the flag would have
  silently no-op'd in daemon/ACP modes — the project's recurring "wire-X-into-daemon/acp"
  defect class. Fixed properly via explicit parameter threading into
  AppBuilder::new/run_daemon/run_acp_server/run_acp_http_server, verified end-to-end
  by both impl-critic and the reviewer independently.
• tester found 2 real AC-relevant test gaps (Sandboxed-skip decision logic, kill-switch
  end-to-end effect) — both closed with new tests in the fix round.
• Reviewer independently re-verified the AppBuilder::new call-site ripple across the
  whole workspace (17 sites) and ran the full commit-gate suite (fmt/clippy/nextest/rustdoc)
  clean.

Acceptance criteria

• --init wizard prompt (default No, Sandboxed-forced-false, unit tested)
• --migrate-config step 89 (idempotent, unit tested)
• TUI/CLI status indicators for decode + source-labeled attach
• --no-mcp-media kill-switch with CLI/daemon/ACP parity
• Playbook: .local/testing/playbooks/mcp-media-passthrough.md
• Coverage-status rows added (main repo root)
• CHANGELOG.md entry
• mdBook docs (book/src/guides/mcp.md, book/src/reference/cli.md)

Test plan

• Full workspace nextest suite: 13891 passed, 0 failures/regressions
• cargo +nightly fmt --check clean
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings clean
• Rustdoc gate clean
• Live-session playbook scenarios (opt-in round-trip, TUI indicators, migrate idempotency, --init walkthrough) — pending, tracked as Untested in coverage-status.md per project convention

Closes #6241