feat(frontend): surface MCP tool permissions per agent — Permissions panel (#82 lot UX/F)

Adds the "Tools MCP IdeA" tab to the project Permissions panel, alongside
the existing "Système" (file/command) tab. Lets the user grant/revoke MCP
tool capabilities per agent or project-wide default, grouped by domain
(Lecture projet, Lecture tickets, Délégation agents, Contexte et mémoire,
Tickets, Travail et exécution, Skills) instead of a flat 25-checkbox list,
per the UX conception in carnet #82.

- domain/ports/adapters (Tauri, HTTP, mock): wire get_mcp_tool_permissions,
  update_project_mcp_tool_permissions, update_agent_mcp_tool_permissions
  (already merged backend API, #82 lots B1-B4) onto PermissionGateway.
- useMcpToolPermissions: view-model owning the durable MCP tool policy
  document, distinct from the file/command permissions in usePermissions.
- McpToolPermissionsPanel: target selector (Défaut projet + agents with
  Hérité/Override badges) and grouped editor — inherited agents are
  read-only until "Créer un override" (prefilled with the effective
  allowlist), per-row Ajouté/Retiré diffing against the project default,
  inline confirmation before granting a write tool at project-default
  level, and unsaved-draft protection on target change.
- mcpToolGroups.ts: presentational-only domain grouping and short French
  labels — the read/write classification itself always comes from the
  backend-provided catalogue, never hardcoded here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/domain/index.ts

@@ -705,6 +705,41 @@ export interface EffectivePermissions {
   fallback: PermissionPosture;
 }
 
+// ---------------------------------------------------------------------------
+// MCP tool permissions (ticket #82) — distinct from the file/command
+// permissions above: an allowlist of exact MCP tool names, applied by the MCP
+// server/bridge before dispatch, not by Landlock/sandbox.
+// ---------------------------------------------------------------------------
+
+/** Allowlist-based MCP tool policy: exact tool names permitted. */
+export interface McpToolPolicy {
+  allowedTools: string[];
+}
+
+/** One agent's MCP tool policy override, replacing the project default entirely. */
+export interface AgentMcpToolPolicyOverride {
+  agentId: string;
+  policy: McpToolPolicy;
+}
+
+/**
+ * Backend-canonical classification of the MCP tool catalogue. The frontend
+ * must treat this as the source of truth for read vs write/action — never
+ * hardcode the split locally (ticket #82 acceptance criteria).
+ */
+export interface McpToolCatalogue {
+  readOnlyTools: string[];
+  writeActionTools: string[];
+}
+
+/** Full per-project MCP tool permission document, mirroring the backend DTO. */
+export interface ProjectMcpToolPermissions {
+  version: number;
+  catalogue: McpToolCatalogue;
+  projectDefault: McpToolPolicy | null;
+  agents: AgentMcpToolPolicyOverride[];
+}
+
 // ---------------------------------------------------------------------------
 // Layout (L4) — mirror of the domain `LayoutTree` (ARCHITECTURE §3, §7).
 // ---------------------------------------------------------------------------