feat(wiki): add private MCP writes and folder imports

[humandebri]

Purpose

• Enable authenticated agents to safely update private Kinic Wiki content and let users import local folders and PDFs in bulk.

Changes

• Add the writer-gated mutate_nodes_batch VFS API and expose only two batch mutation tools, write_nodes and mutate_nodes_batch, through the staging MCP worker.
• Enforce etag checks, indexed conflict details, and transaction rollback so failed batches do not partially update a database.
• Map OAuth mcp:write access to the Internet Identity Actions & questions grant while keeping Questions only sessions read-only, and add a fail-closed write policy with V3 auth state.
• Add cancellable Wiki Browser folder import for Markdown, text, and locally extracted PDF content, with validation, deterministic explorer sorting, and bulk node writes.
• Regenerate the Candid and TypeScript VFS bindings, expand staging smoke coverage and documentation, and update the related JavaScript dependencies.

Staging

• MCP: https://wiki-mcp-staging.kinic.xyz/mcp
• Health: https://wiki-mcp-staging.kinic.xyz/health
• Wiki Browser: https://kinic-wiki-browser-staging.hude.workers.dev

Verification

• GitHub Actions passed the canister build, Rust, Wiki MCP, Wiki Browser, extension, skill registry, wiki generator, regression-group, and macOS/Linux CLI artifact checks.
• The iOS and IC SQLite canister probe jobs were skipped by their workflow conditions.

Impact

• Production MCP remains public and read-only. Staging mutations require both the mcp:write scope and an Internet Identity Actions & questions grant.
• Deploying the V3 auth-state migration invalidates existing staging OAuth clients and sessions, so connected clients must register and connect again.
• The VFS Candid interface gains mutate_nodes_batch; existing single-node operations remain available.