Add standalone topology MCP with skill, scopes UI, and opt-in live sync.

Splits canvas/Fabric tools into netx-topology-mcp, documents install and a companion Cursor skill, lets API keys grant ne:write explicitly, and adds optional topology live sync so operators can watch agent drawing without constant polling.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/i18n/zh.ts

@@ -473,7 +473,7 @@ const zh = {
     colStatus: "状态码",
     colIp: "IP",
     apiKeysTitle: "API Key 管理",
-    apiKeysHint: "生成长期 Token 供 MCP/脚本调用；明文仅创建时显示一次。管理员可为其他用户签发。",
+    apiKeysHint: "生成长期 Token 供 MCP/脚本调用；明文仅创建时显示一次。管理员可为其他用户签发。可勾选权限；拓扑画图需 ne:write。",
     tokenName: "名称",
     expiresIn: "有效期",
     expire7d: "7 天",
@@ -497,6 +497,23 @@ const zh = {
     tokenStatusRevoked: "已吊销",
     revokeToken: "吊销",
     revokeConfirm: "确定吊销该 API Key？",
+    scopesTitle: "权限范围",
+    scopesHint: "勾选后写入 Token；不勾选「继承」时至少选一项。默认 MCP 不含 ne:write，写工具对 Agent 不可见。",
+    scopesInherit: "继承所属用户全部权限",
+    scopesInheritShort: "继承用户",
+    scopesCol: "权限",
+    scopesRequired: "请至少勾选一项权限，或选择继承用户全部权限",
+    scopesNoneAvailable: "当前所属用户没有可授予的权限",
+    scopePresetMcp: "MCP 默认（只读+CLI）",
+    scopePresetTopoWrite: "MCP + 拓扑写",
+    scopeAlarmsRead: "alarms:read 告警只读",
+    scopeNeRead: "ne:read 网元/拓扑只读",
+    scopeNeWrite: "ne:write 网元/拓扑写入（含画图）",
+    scopeNeExec: "ne:exec 托管网元执行命令",
+    scopeWebcrt: "webcrt:session WebCRT",
+    scopeSql: "sql:query SQL 查询",
+    scopeAdminUsers: "admin:users 用户管理",
+    scopeOpsWrite: "ops:write 运维写入",
     forceChangeTitle: "请修改初始密码",
     forceChangeHint: "账号 {{user}} 仍在使用默认密码，登录前必须先修改。",
     oldPassword: "当前密码",
@@ -1369,6 +1386,9 @@ const zh = {
     edgeDiscovered: "发现",
     edgeStale: "未发现",
     fit: "适应画布",
+    liveSync: "实时同步",
+    liveSyncOn: "同步中…",
+    liveSyncHint: "开启后约每 5 秒刷新左侧树、每 3 秒刷新已打开的图（观看 MCP 建图/画拓扑）；默认关闭。不需要先打开画布",
     fullscreen: "全屏显示",
     exitFullscreen: "退出全屏",
     display: "显示",