feat: agent token, auth.agent middleware, /mcp route with HadoServer skeleton

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/tests/Feature/McpAuthTest.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\AgentToken;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class McpAuthTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private const INITIALIZE = [
+        'jsonrpc' => '2.0', 'id' => 1, 'method' => 'initialize',
+        'params' => ['protocolVersion' => '2025-06-18', 'capabilities' => [], 'clientInfo' => ['name' => 'test', 'version' => '0']],
+    ];
+
+    public function test_requires_agent_token(): void
+    {
+        $this->postJson('/mcp', self::INITIALIZE)->assertStatus(401)->assertJsonPath('message', 'Нужен Bearer-токен агента');
+        $this->postJson('/mcp', self::INITIALIZE, ['Authorization' => 'Bearer nope'])->assertStatus(401)->assertJsonPath('message', 'Неизвестный токен агента');
+    }
+
+    public function test_remote_user_header_is_not_enough(): void
+    {
+        $this->postJson('/mcp', self::INITIALIZE, ['X-Remote-User' => 'nikita'])->assertStatus(401);
+    }
+
+    public function test_valid_token_reaches_the_server(): void
+    {
+        $user = User::create(['login' => 'nikita', 'tz' => 'UTC']);
+        AgentToken::create(['user_id' => $user->id, 'token_hash' => hash('sha256', 'secret')]);
+
+        $this->postJson('/mcp', self::INITIALIZE, ['Authorization' => 'Bearer secret'])
+            ->assertOk()
+            ->assertJsonPath('result.serverInfo.name', 'Hado');
+    }
+}