console: WIP in-console MCP panels and \ask agent

[leedqin]

Draft, not for merge. Dev-server only and ungated. Opening this for
visibility and to hand the work off.

What this adds

An in-console AI agent plus the MCP-backed surfaces around it:

• \ask <question> in the SQL Shell, which runs a tool-use loop against the
  system catalog and answers in plain English, printing each query it ran.
• Four MCP-backed diagnostic slash commands: \health, \freshness,
  \sources, \products.
• Three MCP-backed panels: attention feed and data products on the environment
  overview, freshness on materialized view detail, and an impact banner on
  cluster overview.

Architecture

The browser orchestrates the tool-use loop. This is the part worth reviewing,
because it is meant to be the production shape and not just a demo shortcut:

• Catalog reads go straight from the browser through the user's own
  authenticated session, hitting /api/mcp/developer and /api/mcp/agent.
  RBAC is preserved for free, with no server-side privilege model to build or
  to get wrong.
• Only the model completion is proxied, because a client-only SPA cannot
  hold an Anthropic key. Today that proxy is a Vite dev-server middleware that
  reads ANTHROPIC_API_KEY server-side and forwards to the Messages API.
• The system prompt points the model at the built-in ontology relations
  first, so it discovers real table and column names instead of guessing
  them. This is the piece that keeps generated joins correct, and it leans on
  catalog facts that are hard to replicate elsewhere, for instance
  mz_materialization_lag already naming the bottleneck input.

Model is claude-opus-5, pinned in both the agent and the proxy fallback.

What blocks merging

• No feature gating. The three panels render unconditionally on the
  environment overview, cluster overview, and MV detail pages. Each needs a
  LaunchDarkly flag.
• No production key path. /api/ask is registered in configureServer,
  so it exists only under yarn start. A production build has no /api/ask
  and \ask fails there. Cloud console is on Vercel, so the shape there is a
  Vercel Function; self-managed console is served by environmentd and needs its
  own key-holding sidecar.
• No streaming. The proxy buffers the whole completion, so the shell sits
  on "Investigating..." until the full answer lands.
• No tests. Neither the agent loop, the proxy, nor the panels are covered.
• The MV freshness panel derives lag severity by string-matching interval text,
  which should read a typed interval instead.

Docs

console/doc/ask-agent.md covers running it locally, how the key is handled,
what the target environment must provide (the MCP endpoint flags, the ontology
relations, and the CORS-allowed-origin requirement when pointing at a bare
emulator), and the same gap list above.

Tests

None added. See the gap list.