feat(worker): add external MCP endpoint with API-key auth

A second WebApplication runs the external MCP server on its own port (default 47822) so it can expose a different tool set under different auth than the internal /mcp endpoint. Shared singletons (config, broadcaster, queue, db factory) are injected by instance so both apps share runtime state. ExternalMcpAuthMiddleware enforces an optional X-ClaudeDo-Key header; loopback-only trust when no key is configured.

Tools: ListTaskLists, ListTasks, GetTask, AddTask, UpdateTaskStatus, RunTaskNow, CancelTask.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ClaudeDo.Worker/Config/WorkerConfig.cs

@@ -31,6 +31,14 @@ public sealed class WorkerConfig
     [JsonPropertyName("claude_bin")]
     public string ClaudeBin { get; set; } = "claude";
 
+    /// <summary>Port for the external MCP endpoint. 0 disables the external listener entirely.</summary>
+    [JsonPropertyName("external_mcp_port")]
+    public int ExternalMcpPort { get; set; } = 47_822;
+
+    /// <summary>Optional API key clients must pass via X-ClaudeDo-Key header. Null/empty = loopback trust only.</summary>
+    [JsonPropertyName("external_mcp_api_key")]
+    public string? ExternalMcpApiKey { get; set; }
+
     public static string DefaultConfigPath =>
         Path.Combine(Paths.AppDataRoot(), "worker.config.json");