feat(mcp): add Context.dev marketplace connector

[luoye520ww]

Summary

• Add a Context.dev remote MCP connector preset to the marketplace.
• Configure streamable HTTP at https://mcp.context.dev/mcp with OAuth 2.1 dynamic client registration and PKCE (no client secret or API key in persisted config).
• Document production capabilities and explicitly exclude the unreleased Answers API.

Changes

• Add the context-dev marketplace entry with permission/setup preview, HTTPS docs allowlist, and encrypted runtime OAuth configuration.
• Add English and Simplified Chinese localization in a dedicated locale fragment.
• Add README documentation and regression coverage for catalog/config/security behavior.

Behavior before

Context.dev had to be added manually as an opaque remote MCP server, with no discoverable preset or OAuth configuration guidance.

Behavior after

Users can open the MCP marketplace, review the Context.dev permission preview, and add a user-scoped streamable HTTP server. Kun's existing MCP OAuth runtime performs interactive authorization and stores tokens in its encrypted OAuth store; mcp.json contains no credential material.

Safety

• Endpoint and docs links are restricted to the exact HTTPS origins.
• clientId and clientSecret remain unset so dynamic registration/PKCE is used; no token is persisted in config or logged.
• Returned pages, documents, and extracted text are labeled as untrusted external content.
• The preset does not configure the unreleased Answers API.

Typecheck

npm.cmd run typecheck
npm.cmd --prefix kun run typecheck

Both passed with exit code 0.

Tests

npm.cmd exec vitest run src/renderer/src/components/PluginMarketplaceView.test.ts
npm.cmd --prefix kun test -- src/adapters/tool/mcp-oauth-provider.test.ts src/adapters/tool/mcp-transport.test.ts
npm.cmd run test:packaging
npm.cmd run lint
npm.cmd run build

• Marketplace tests: 35 passed.
• MCP OAuth/transport tests: 10 passed.
• Packaging tests: 10 passed, 2 platform-mode skips.
• Lint: passed (existing warnings only).
• Build: passed; runtime dependency check passed.

Actual validation

A local mock-independent OAuth provider/transport test suite passed. Live Context.dev authorization requires a user account and remains the only external validation.

Issue

Fixes #1294

[XingYu-Zhong]

不想加外部源，也没理由给他们到流量