feat: allow MCP admin CREATE/ALTER; keep DROP and TRUNCATE blocked

[venkateshsakamuri-lab]

Summary

Coding agents were blocked from DDL because MCP bearer SQL used a hard-coded read-only QueryExecutionContext. Admins can now run DML and non-destructive DDL (CREATE, ALTER, CREATE INDEX) through execute_sql / deepsql query with the same confirmation, privilege, and WHERE gates as the SQL Editor.

DROP and TRUNCATE stay blocked on MCP and coding-agent loops even with confirmMutation: true. The web SQL Editor is unchanged: it still blocks only DROP TABLE; other Editor DROPs and TRUNCATE remain confirm-gated.

apply_index_recommendation is still the only MCP path that can drop an index (server-generated DDL).

Policy

Surface	CREATE / ALTER / DML	DROP / TRUNCATE
MCP bearer, developer	403	403
MCP bearer, admin, no confirm	requiresConfirmation	blocked (UNSAFE_MUTATION_BLOCKED)
MCP bearer, admin, confirmMutation=true	runs (WHERE still required for UPDATE/DELETE)	still blocked
SQL Editor	unchanged	DROP TABLE blocked; other DROP / TRUNCATE confirmable

Changes

• QueryExecutionContext.mcp(...) is MAY_MUTATE for admins and accepts mutationConfirmed
• QueryExecutionPolicyService blocks MCP DROP* / TRUNCATE (including EXPLAIN-wrapped forms)
• SchemaController and ExplainController pass MCP vs Editor origin plus confirmation through forSqlSurface
• MCP tool copy, CLI help, agent SOUL, and docs updated; @deepsql/mcp bumped to 0.28.0

Testing

Backend unit tests (QueryExecutionPolicyServiceTest, QueryExecutionContextTest, ExplainControllerPolicyTest, McpTokenServiceTest): 63 passed.

MCP package: npm test — 269 passed.

Live against ACME ERP with an admin MCP token:

• unconfirmed CREATE TABLE → EDITOR_MUTATION_CONFIRMATION_REQUIRED
• confirmed CREATE TABLE / ALTER TABLE / CREATE INDEX → 200 success
• confirmed MCP DROP TABLE / TRUNCATE / DROP INDEX → UNSAFE_MUTATION_BLOCKED
• Editor JWT TRUNCATE and DROP INDEX still succeed; Editor DROP TABLE still blocked