[Improve] Consolidate MCP tool availability into approval modes

[roomote-roomote]

​Created by Roomote. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Keep the legacy checkbox and Save fallback when integrationToolApprovals is off, while using the approval policy controls when the experiment is on.
• Replace staged per-tool availability checkboxes with the approval policy controls in the MCP tool-management dialogs when enabled.
• Rename the policy's internal Reject choice to Disable and enforce it as unavailable and hidden from model tool listings, including native in-process MCP handlers.
• Add Auto-first four-button rows for individual tools and groups, with mixed groups showing no selected mode.
• Add the shared Radix-based ToggleButton primitive and migrate legacy disabledTools state into the policy surface while retaining rollback-compatible storage.
• Refetch settled policy state after queued save failures so consecutive failed optimistic updates cannot restore an earlier mode.
• Track pending operation revisions so an older completion cannot clear a newer queued optimistic mode before that operation settles.
• Reapply any selection made while a failure refetch is in flight before the newer save settles.
• Defer the required server-truth refetch until the final queued operation settles, including when a later queued write succeeds.

Why this change was made

Tool availability and approval were separate controls with conflicting save behavior once the approval experiment is enabled. The fallback preserves existing deployments until the experiment is enabled, while the policy surface makes the model-facing outcome explicit.

Impact

Admins and personal custom-server owners now set tool behavior through Auto, Always allow, Always ask, or Disable controls when approvals are enabled; existing deployments retain the legacy availability editor until then. Disable hides the tool from tools/list and refuses calls at proxy and native MCP boundaries. Queued policy writes now preserve newer optimistic modes through failure refetches until their own save settles, and deferred refetches run after later queued successes. Focused web tests (141) and the personal-policy test (3) pass; visual proof timed out under the shared capture deadline, so no screenshot artifact is included.

[roomote-community]

No code issues found. See task

• apps/web/src/components/settings/IntegrationToolApprovalControls.tsx:236 leaves all tool availability controls unavailable when the approvals experiment is off.
• apps/web/src/trpc/commands/integration-tool-policies/index.ts:156 invokes unmocked database APIs in the existing personal-policy command test.
• apps/web/src/hooks/useIntegrationToolPolicies.ts:193 restores a stale optimistic mode when consecutive queued policy updates both fail.
• apps/web/src/hooks/useIntegrationToolPolicies.ts:223 can let the failure-triggered refetch clear a mode selected while that refetch is in flight.
• apps/web/src/hooks/useIntegrationToolPolicies.ts:232 can skip the eventual server-truth refetch after a failed policy update when another queued update succeeds.

_{Reviewed 2951958}

[roomote-roomote]

Pushed commit 2951958.

Fixed the deferred-refresh race: failed policy writes now mark server-truth refresh as pending, and the refresh runs after the final queued operation settles, while any optimistic selections made during the refetch are reapplied. Added regression coverage for first failure/second success with an unrelated tool, the in-flight refetch/new selection race, and consecutive failures.

Validation:

• Focused web tests: 5 files, 141 passed.
• Personal policy command test: 3 passed.
• Web typecheck/lint, root fast typecheck/lint, knip, diff check, and pre-push checks passed.
• GitHub Test and Roomote code review checks are green for 2951958.
• Visual proof timed out under the shared deadline; no screenshot artifact was retained.

The outstanding review thread was resolved after the fix and validation were pushed.