Integrate core functionality for tools, MCP, and enhanced session management

Adds consent management for tool execution, input validation, sandboxed process execution, and MCP server integration. Updates session management to support tool use, conversation persistence, and streaming responses.

Major additions:
- Database migrations for conversations and secure storage
- Encryption and credential management infrastructure
- Extensible tool system with code execution and web search
- Consent management and validation systems
- Sandboxed process execution
- MCP server integration

Infrastructure changes:
- Module registration and workspace dependencies
- ToolCall type and tool-related Message methods
- Privacy, security, and tool configuration structures
- Database-backed conversation persistence
- Tool call tracking in conversations

Provider and UI updates:
- Ollama provider updates for tool support and new Role types
- TUI chat and code app updates for async initialization
- CLI updates for new SessionController API
- Configuration documentation updates
- CHANGELOG updates

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

crates/owlen-core/src/mcp/mod.rs

@@ -0,0 +1,82 @@
+use crate::tools::registry::ToolRegistry;
+use crate::validation::SchemaValidator;
+use crate::Result;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Duration;
+
+/// Descriptor for a tool exposed over MCP
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct McpToolDescriptor {
+    pub name: String,
+    pub description: String,
+    pub input_schema: Value,
+    pub requires_network: bool,
+    pub requires_filesystem: Vec<String>,
+}
+
+/// Invocation payload for a tool call
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct McpToolCall {
+    pub name: String,
+    pub arguments: Value,
+}
+
+/// Result returned by a tool invocation
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct McpToolResponse {
+    pub name: String,
+    pub success: bool,
+    pub output: Value,
+    pub metadata: HashMap<String, String>,
+    pub duration_ms: u128,
+}
+
+/// Thin MCP server facade over the tool registry
+pub struct McpServer {
+    registry: Arc<ToolRegistry>,
+    validator: Arc<SchemaValidator>,
+}
+
+impl McpServer {
+    pub fn new(registry: Arc<ToolRegistry>, validator: Arc<SchemaValidator>) -> Self {
+        Self {
+            registry,
+            validator,
+        }
+    }
+
+    /// Enumerate the registered tools as MCP descriptors
+    pub fn list_tools(&self) -> Vec<McpToolDescriptor> {
+        self.registry
+            .all()
+            .into_iter()
+            .map(|tool| McpToolDescriptor {
+                name: tool.name().to_string(),
+                description: tool.description().to_string(),
+                input_schema: tool.schema(),
+                requires_network: tool.requires_network(),
+                requires_filesystem: tool.requires_filesystem(),
+            })
+            .collect()
+    }
+
+    /// Execute a tool call after validating inputs against the registered schema
+    pub async fn call_tool(&self, call: McpToolCall) -> Result<McpToolResponse> {
+        self.validator.validate(&call.name, &call.arguments)?;
+        let result = self.registry.execute(&call.name, call.arguments).await?;
+        Ok(McpToolResponse {
+            name: call.name,
+            success: result.success,
+            output: result.output,
+            metadata: result.metadata,
+            duration_ms: duration_to_millis(result.duration),
+        })
+    }
+}
+
+fn duration_to_millis(duration: Duration) -> u128 {
+    duration.as_secs() as u128 * 1_000 + u128::from(duration.subsec_millis())
+}