Add standalone topology MCP with skill, scopes UI, and opt-in live sync.

Splits canvas/Fabric tools into netx-topology-mcp, documents install and a companion Cursor skill, lets API keys grant ne:write explicitly, and adds optional topology live sync so operators can watch agent drawing without constant polling.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/i18n/en.ts

@@ -477,7 +477,7 @@ const en = {
     colIp: "IP",
     apiKeysTitle: "API Key management",
     apiKeysHint:
-      "Create long-lived tokens for MCP/scripts. The secret is shown only once. Admins can issue keys for other users.",
+      "Create long-lived tokens for MCP/scripts. The secret is shown only once. Admins can issue keys for other users. Pick scopes; topology drawing needs ne:write.",
     tokenName: "Name",
     expiresIn: "Expiry",
     expire7d: "7 days",
@@ -501,6 +501,24 @@ const en = {
     tokenStatusRevoked: "Revoked",
     revokeToken: "Revoke",
     revokeConfirm: "Revoke this API key?",
+    scopesTitle: "Scopes",
+    scopesHint:
+      "Scopes are stored on the token. Without Inherit, pick at least one. MCP default omits ne:write so write tools stay hidden from the agent.",
+    scopesInherit: "Inherit all owner scopes",
+    scopesInheritShort: "Inherit owner",
+    scopesCol: "Scopes",
+    scopesRequired: "Select at least one scope, or inherit all owner scopes",
+    scopesNoneAvailable: "This owner has no grantable scopes",
+    scopePresetMcp: "MCP default (read + CLI)",
+    scopePresetTopoWrite: "MCP + topology write",
+    scopeAlarmsRead: "alarms:read Alarms read",
+    scopeNeRead: "ne:read NE / topology read",
+    scopeNeWrite: "ne:write NE / topology write (draw)",
+    scopeNeExec: "ne:exec Managed NE exec",
+    scopeWebcrt: "webcrt:session WebCRT",
+    scopeSql: "sql:query SQL",
+    scopeAdminUsers: "admin:users User admin",
+    scopeOpsWrite: "ops:write Ops write",
     forceChangeTitle: "Change initial password",
     forceChangeHint: "Account {{user}} is still using the default password. You must change it before continuing.",
     oldPassword: "Current password",
@@ -1375,6 +1393,9 @@ const en = {
     edgeDiscovered: "Discovered",
     edgeStale: "Missing",
     fit: "Fit view",
+    liveSync: "Live sync",
+    liveSyncOn: "Syncing…",
+    liveSyncHint: "Poll the tree about every 5s and the open map every 3s (watch MCP create/draw). Off by default. No need to open a map first",
     fullscreen: "Fullscreen",
     exitFullscreen: "Exit fullscreen",
     display: "Display",

web/src/i18n/zh.ts

@@ -473,7 +473,7 @@ const zh = {
     colStatus: "状态码",
     colIp: "IP",
     apiKeysTitle: "API Key 管理",
-    apiKeysHint: "生成长期 Token 供 MCP/脚本调用；明文仅创建时显示一次。管理员可为其他用户签发。",
+    apiKeysHint: "生成长期 Token 供 MCP/脚本调用；明文仅创建时显示一次。管理员可为其他用户签发。可勾选权限；拓扑画图需 ne:write。",
     tokenName: "名称",
     expiresIn: "有效期",
     expire7d: "7 天",
@@ -497,6 +497,23 @@ const zh = {
     tokenStatusRevoked: "已吊销",
     revokeToken: "吊销",
     revokeConfirm: "确定吊销该 API Key？",
+    scopesTitle: "权限范围",
+    scopesHint: "勾选后写入 Token；不勾选「继承」时至少选一项。默认 MCP 不含 ne:write，写工具对 Agent 不可见。",
+    scopesInherit: "继承所属用户全部权限",
+    scopesInheritShort: "继承用户",
+    scopesCol: "权限",
+    scopesRequired: "请至少勾选一项权限，或选择继承用户全部权限",
+    scopesNoneAvailable: "当前所属用户没有可授予的权限",
+    scopePresetMcp: "MCP 默认（只读+CLI）",
+    scopePresetTopoWrite: "MCP + 拓扑写",
+    scopeAlarmsRead: "alarms:read 告警只读",
+    scopeNeRead: "ne:read 网元/拓扑只读",
+    scopeNeWrite: "ne:write 网元/拓扑写入（含画图）",
+    scopeNeExec: "ne:exec 托管网元执行命令",
+    scopeWebcrt: "webcrt:session WebCRT",
+    scopeSql: "sql:query SQL 查询",
+    scopeAdminUsers: "admin:users 用户管理",
+    scopeOpsWrite: "ops:write 运维写入",
     forceChangeTitle: "请修改初始密码",
     forceChangeHint: "账号 {{user}} 仍在使用默认密码，登录前必须先修改。",
     oldPassword: "当前密码",
@@ -1369,6 +1386,9 @@ const zh = {
     edgeDiscovered: "发现",
     edgeStale: "未发现",
     fit: "适应画布",
+    liveSync: "实时同步",
+    liveSyncOn: "同步中…",
+    liveSyncHint: "开启后约每 5 秒刷新左侧树、每 3 秒刷新已打开的图（观看 MCP 建图/画拓扑）；默认关闭。不需要先打开画布",
     fullscreen: "全屏显示",
     exitFullscreen: "退出全屏",
     display: "显示",