Add Image Generation Assistant with local MCP server support

[donework]

Summary

• Adds a new "Image Generation Assistant" that refines a rough image description via a configured LLM, then calls an image-generation tool on a locally configured MCP (Model Context Protocol) server over Streamable HTTP and displays the result in the chat.
• Adds a thin MCP client (Tools/MCPClient/) built on the official ModelContextProtocol SDK, with a generous 10-minute timeout to accommodate slow local image generation.
• Adds a dedicated settings dialog for the MCP server URL, an optional bearer token, tool discovery and a required trust/security policy for the MCP server (mirrors the existing ERI data source trust model).
• Shows a separate "MCP Server Trust" indicator in the assistant's footer, styled consistently with (but independent of) the existing LLM provider confidence card, since the two are separate data-sharing risks.
• Adds a native "Download image" action.
• Wires the new assistant into the standard enterprise visibility controls (ConfigurableAssistant / HiddenAssistants), including documenting the new value in the enterprise configuration plugin example.

Notes / limitations

• Only a single MCP server can be configured per app (no multi-server management yet, unlike ERI data sources).
• Only bearer-token auth is supported for the MCP server.
• The MCP tool is expected to accept a single prompt string argument and return an ImageContentBlock in its result; other response shapes are treated as a failure.

Test plan

• New "Image Generation" tile appears under Assistants → General
• Settings dialog: entering an MCP server URL + "Test connection & load tools" correctly lists and lets you pick a tool
• Assistant refuses to run with a clear message if the MCP server URL/tool or the security policy is not yet configured
• Generating an image: shows a progress bar (no stray "AI is answering" bubble) while refining the prompt and calling the MCP tool, then displays the resulting image
• "Download image" opens a native save dialog and writes a valid image file
• "MCP Server Trust" footer indicator reflects the configured security policy and matches the subtle icon-color styling of the existing confidence card