feat(safety): global read-only mode, mutation audit trail, MCP tool allowlist

[ritikbansod]

Implements F7 — the AI/MCP safety pack from the deep analysis: "the Kafka tool that can prove what an agent did and refuse to let agents write." Pairs with the auth feature in #2. Stacked on #2 (touches SecurityConfig.java, CHANGELOG.md, README.md, cli/kview.mjs, mcp/kview-mcp.js there) — merge #1 → #2 → this.

What's added

Global read-only mode — KVIEW_READONLY=true

• Every mutation is refused with a clear 403 (Kview is running in read-only mode…), for all clients and all roles. Implemented as a filter ahead of the security chain, so the reason is "read-only" rather than "unauthorized".
• Reads — including the read-shaped POSTs (browse, decode, encode, test) — keep working.
• The web UI shows a 🔒 banner (fetched from the new public GET /api/meta, which also lets scripts detect the mode).

Mutation audit trail — KVIEW_AUDIT=true

• One append-only JSONL line per mutation in <data-dir>/audit.log: timestamp, client, method, full path (cluster + topic + action) and response status. Message payloads are never logged.
• All three official clients now identify themselves with an X-Kview-Client header — kview-ui, kview-cli/<v>, kview-mcp/<v> — so an AI agent's writes are distinguishable from a human's. Unknown clients fall back to their User-Agent.

MCP per-tool allowlist — KVIEW_ALLOWED_TOOLS

• Comma-separated tool names; when set, only those tools are advertised in tools/list and dispatchable, and a disallowed tools/call gets an error listing the enabled tools. E.g. serve an agent only kview_overview,kview_browse,kview_topics. Builds on the existing confirm=true guard for destructive calls.

Verification

• New tests (6): read-only matrix (mutation refused with the read-only reason in no-auth mode; reads and read-shaped POSTs fine; /api/meta public and reporting readonly:true), audit trail (mutation lines with method/path/status/client; reads not audited).
• MCP allowlist verified over stdio: allowlist of 2 serves exactly 2, disallowed call refused with the enabled list, no allowlist serves all 16.
• Full suite: 49/49 green.
• Not covered: audit-log rotation (single append-only file — document rotation at the OS level if needed); UI write-buttons are disabled server-side but not individually hidden (banner + clear 403 toasts for now).