fix(web+docs): the MCP team opt-out is documented at project, program and workspace scope but only exists at project

Found by the 0.4 built-vs-promised audit (2026-08-01).

Problem

docs/administration/mcp-server.md:346-350:

A team has its own, over reads of its own data: Project settings -> Agents -> Agent read access. The same control exists at program scope (Program settings -> Agents) and at workspace scope.

Only project scope exists. Verified:

  • packages/web/src/features/settings/ProjectSettingsPage.tsx:236 — label: 'Agents' ✅
  • packages/web/src/features/settings/workspace/workspaceNav.tsx:112-164 — enumerates 20 workspace sections; no agents entry ❌
  • packages/web/src/features/settings/ProgramSettingsPage.tsx and settings/program/ — no Agents section anywhere ❌

What does work

The mechanism itself is real and correct. apps/projects/mcp_settings.py::resolve_mcp_enabled genuinely computes the instance -> workspace -> program -> project cascade, and TRUEPPM_MCP_ENABLED is enforced first in the permission chain (apps/access/permissions.py:1224-1231). The cascade resolves those scopes; there is simply no UI to set them at two of the four.

So the switch does not lie about its effect — the docs lie about where to find it. An operator following the runbook to "Program settings -> Agents" or the workspace equivalent hits a dead end and has to discover the env-var-plus-restart path unaided.

Fix — pick one

  1. Build the workspace and program Agents sections so the docs become true (preferred: the cascade already supports them, and "a self-hoster administers TruePPM from the UI, not from a settings file" is the stated 0.4 position), or
  2. Correct mcp-server.md to say the team control exists at project scope only, and that workspace/program scope is set via the API or env var today.