feat: add stored MCP preflight probe

[KirschBluteX]

Why

Cloud automation preflight must test the user's already-stored MCP connection without sending its configuration or credentials through the automation service response.

Related to OpenHands/OpenHands#16565.

Summary

• add POST /api/v1/settings/mcp/{settings_key}/test under the existing authenticated settings router
• resolve the stored server internally and reuse the agent-server MCP probe
• make repository and branch searches follow provider pagination without dropping page-boundary results
• reject empty, non-positive, page-one, and malformed page tokens; distinguish a disconnected provider (403) from a sanitized provider failure (503)
• return only { "ok": boolean } from the MCP probe, with bounded input, a sanitized 404 for missing servers, and a sanitized 503 for internal failures

How to test

• python -m pytest tests/unit/app_server/test_git_router.py tests/unit/app_server/test_settings_api.py -q — 54 passed
• scoped pre-commit hooks — trailing whitespace, EOF, debug statements, Ruff, Ruff format, and mypy passed
• the AppMode guard's equivalent rg check found no AppMode.OSS usage; the commit hook also passed the guard

Companion changes

• Automation: feat: harden automation draft preflight validation automation#341
• Agent Canvas: feat: harden automation preflight validation OpenHands#16614
• Software Agent SDK: feat: add repository access preflight software-agent-sdk#4504
• Extensions: test: cover automation preflight requirements extensions#476