Keep mcp_server_enabled in sync with source fields

What does this MR do and why?

When duo_features_enabled or experiment_features_enabled is updated on a root-level group's namespace settings, mcp_server_enabled must be recomputed. Without this callback, mcp_server_enabled goes stale between backfill and feature flag enablement windows.

References

https://gitlab.com/gitlab-com/request-for-help/-/work_items/4926

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Find or create a root-level group with Duo enabled.

   g = Group.find_by_path('gitlab-duo')
   ns = g.namespace_settings

2. Set a known base state, both source fields true, mcp_server_enabled false.

   ns.update_columns(duo_features_enabled: true, experiment_features_enabled: true, mcp_server_enabled: false)
   ns.reload.mcp_server_enabled  # => false (callback not fired)

3. Disable duo_features_enabled and save, verify mcp_server_enabled flips to false.

   ns.update!(duo_features_enabled: false)
   ns.reload.mcp_server_enabled  # => false

4. Re-enable duo_features_enabled and save, verify mcp_server_enabled flips back to true.

   ns.update!(duo_features_enabled: true)
   ns.reload.mcp_server_enabled  # => true

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.