Move MCP server setup diagnostic out of EE Duo namespace

What does this MR do and why?

Move MCP server setup diagnostic out of EE Duo namespace

The gitlab:duo:verify_mcp_server_setup rake task lived under ee/lib/gitlab/duo/administration, but MCP server access is gated solely by the mcp_server_enabled setting (a CE feature) plus a SaaS-only namespace check. Nesting it under EE/Duo mischaracterized MCP as a Duo-gated, EE-only feature and had drifted to check duo_features_enabled/instance_level_ai_beta_features_enabled, which no longer affect MCP access after removing the mcp_server_availability_setting flag.

This MR splits into a CE class (lib/gitlab/mcp/administration) that checks the instance-level setting, with an EE override (ee/lib/ee/gitlab/mcp/administration) adding the SaaS-only namespace check, mirroring the same split already used by the real MCP endpoint in lib/api/mcp/base.rb and ee/lib/ee/api/mcp/base.rb. The rake task moves from gitlab:duo:verify_mcp_server_setup to gitlab:mcp:verify_setup.

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. In rails console, disable the MCP server setting.

   Gitlab::CurrentSettings.update!(mcp_server_enabled: false)

2. Run the task with a user, on a non-SaaS instance:

   bin/rake "gitlab:mcp:verify_setup[root]"

3. Expect the MCP check to fail.
4. Update the setting and rerun the task and expect the MCP check to pass.
5. Run the task with a user, on a SaaS instance:

   GITLAB_SIMULATE_SAAS=1 bin/rake "gitlab:mcp:verify_setup[root]"

6. Verify that it passes if the user belongs to a root group that has mcp_server_enabled enabled.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.