fix(mcp): refuse every server start while MCP is off

[datlechin]

Why

Turning Enable MCP Server off did not keep the listener down. tablepro://integrations/start-mcp, pairing and the bridge's lazy start all bound it anyway, because the toggle was checked only at launch.

Change

• MCPServerManager.performStart, which every start path reaches, refuses while MCP is off and throws a typed error naming Settings > MCP.
• start-mcp writes a refusal file; tablepro-mcp reads it and fails within a poll interval instead of timing out after 10 seconds. A TablePro launched only for that refused start quits again.
• Pairing stops before the approval sheet, with an alert and Open MCP Settings.
• Breaking: anyone relying on the lazy start must turn MCP on. CHANGELOG has the entry.
• Quitting a client-launched session with nothing open no longer erases Reopen Last Session.

Security: narrows access only. With MCP off no path binds a listener; nothing new is reachable.

Verified

MCPServerOffContractTests drives launch, start-mcp, the Settings restart and pairing with MCP off and asserts no listener, no handshake and the typed error. MCPBridgeRefusalTests covers the bridge's fast failure and a stale refusal.

Docs: TableProApp/docs#7