Phase 0: scheduleragent + mcp-server read-only agent framework

Complete the natural-language scheduler agent's Phase 0 read-only pipeline:

Task #2 (API Key auth mechanism):
- New store/apikey.go: APIKey store (hash, validate, expiry)
- controllers/apikey.go: GenerateAPIKey finally persists + registers RBAC role
- controllers/auth.go: GetUsernameFromToken recognizes xce_ak_ prefix
- middleware/validatehandler.go: isValidToken handles API Key
- config/rbac.yaml: mcp_readonly role (view-only permissions)
- 6 new test files covering unit + integration full-chain

Task #3 (schedulerclient Go library):
- types.go: URM types (URMJob/URMQueue/URMNode/JobStatus/Metrics)
- client.go: read-only Client interface (6 methods)
- httpclient.go: resty-based HTTP implementation
- statusmap.go + _test.go: TDD status mapping (33 tests)

Task #4 (mcp-server binary):
- cmd/main.go: entry, reads XCE_API_URL/XCE_API_KEY, registers 6 MCP tools
- internal/app.go: tool handlers wiring schedulerclient to MCP stdio
- Uses github.com/mark3labs/mcp-go@v0.57.0 for stdio transport

All: go vet clean, go build clean, schedulerclient 33/33 tests pass.
mcp-server binary ~11MB arm64, CGO_ENABLED=0.

Architecture:
  Claude Code --stdio--> mcp-server --HTTP--> apiserver REST API --cgo--> C backend

Co-Authored-By: Claude <noreply@anthropic.com>

src/frontend/schedulerclient/client.go

@@ -0,0 +1,39 @@
+package schedulerclient
+
+import "context"
+
+// ── Client interface ────────────────────────────────────────────────────────
+
+// Client provides read-only access to the scheduler cluster through a
+// scheduler-agnostic unified resource model (URM).
+//
+// Implementations talk to the apiserver's REST API and authenticate via
+// either a Bearer JWT token or an XCE API Key (xce_ak_ prefix).
+type Client interface {
+	// ── Jobs ──
+
+	// ListJobs returns jobs matching the given filter.
+	// An empty filter returns all visible jobs.
+	ListJobs(ctx context.Context, filter JobFilter) ([]*URMJob, *Page, error)
+
+	// GetJob returns a single job by its ID.
+	GetJob(ctx context.Context, id string) (*URMJob, error)
+
+	// GetJobLogs retrieves output logs for a job.
+	GetJobLogs(ctx context.Context, id string, opts LogOpts) ([]string, error)
+
+	// ── Queues ──
+
+	// ListQueues returns all visible queues with their current state.
+	ListQueues(ctx context.Context) ([]*URMQueue, error)
+
+	// ── Nodes ──
+
+	// ListNodes returns all visible compute nodes with resource usage.
+	ListNodes(ctx context.Context) ([]*URMNode, error)
+
+	// ── Metrics ──
+
+	// GetClusterMetrics returns a snapshot of overall cluster resource usage.
+	GetClusterMetrics(ctx context.Context) (*Metrics, error)
+}