feat(mcp): always register list_trips & get_trip_summary; inject deprecation notice into tool results

Navigation tools:
- list_trips and get_trip_summary are now always registered for any
  OAuth session regardless of granted scopes — they are required for
  trip ID discovery before any scoped tool can be used
- get_trip_summary filters optional sections (budget, packing, collab,
  reservations) by the client's OAuth scopes when called without trips:read

Deprecation notice:
- Inject static token deprecation warning into the first tool result
  (list_trips or get_trip_summary) via a per-session closure so Claude
  is forced to surface it — the instructions field alone is only
  background context and is not proactively shown to the user

UI:
- OAuth client creation modal: add hint explaining the always-available
  tools, remove the "must select at least one scope" submit guard
- OAuth consent screen: add "Always included" section showing list_trips
  and get_trip_summary; handles zero-scope clients gracefully (empty
  permissions section is hidden)

server/src/mcp/index.ts

@@ -253,8 +253,18 @@ export async function mcpHandler(req: Request, res: Response): Promise<void> {
       instructions: BASE_MCP_INSTRUCTIONS + (isStaticToken ? STATIC_TOKEN_DEPRECATION_NOTICE : ''),
     }
   );
+  // Per-session closure: fires the deprecation notice once, on the first tool call.
+  // Tool results are the only mechanism Claude reliably surfaces to the user;
+  // the instructions field is only background context and won't trigger a proactive warning.
+  let _noticeEmitted = false;
+  const getDeprecationNotice = (): string | null => {
+    if (!isStaticToken || _noticeEmitted) return null;
+    _noticeEmitted = true;
+    return STATIC_TOKEN_DEPRECATION_NOTICE;
+  };
+
   registerResources(server, user.id, scopes);
-  registerTools(server, user.id, scopes, isStaticToken);
+  registerTools(server, user.id, scopes, isStaticToken, getDeprecationNotice);
 
   const transport = new StreamableHTTPServerTransport({
     sessionIdGenerator: () => randomUUID(),