Netx tools: load from netx remote /mcp, add per-tool toggles

- Drop the TypeScript netx tool implementations and the hard-coded
  TOOLS_BY_GROUP list; register netx__* tools from the server's
  tools/list (group from _meta.netx.group) and forward tools/call.
- Thin Streamable HTTP client on standard fetch (fetchImpl injectable);
  cached catalog when netx is unreachable, refresh to reconnect.
- disabledTools (deny list; new server tools follow their group) and
  readOnlyOnly (only readOnlyHint=true tools), re-registered live.
- Settings card: per-group expandable tool rows with switches and a
  write marker; skills append a disabled-tools note.
- Toggles only control model visibility; netx enforces security.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/netx/runtime.ts

@@ -64,6 +64,8 @@ export function provisionalNetxConnection(): NetxToolConnection {
       : 'zh'),
     toolCallTimeoutMs: 120_000,
     groups: DEFAULT_CAPABILITY_GROUPS,
+    disabledTools: [],
+    readOnlyOnly: false,
     groupKbInPreset: true,
     groupKbPublic: false,
   }