[grade=A urn:ump:5clu4udrbwuwxn74tqwxtukfjnrwkrbiykp6uh66ipipzxr32xsq] Merge dc/DC-166-mcp-completion (e524d16): MCP 17->28 tools + workflows double-prefix fix

Resolves 0 conflicts (auto-merge; the branches touched disjoint regions
of src/mcp/mcp-core.js). Fixes audit P0-4 (DC-166 drift: the fix branch
was never merged, so the branch shipped 17 tools while changelog/
capabilities claimed the expanded set, and the workflows UI was broken)
and the production Workflows outage.

Incoming:
- src/mcp/mcp-core.js: 11 new tool handlers over existing routes
  (calendar events/add_source, security events/summary, license_status,
  capabilities, DNS add/remove record, deploy_recipe, run_workflow,
  tailscale_status); DC-162 machine-only gate preserved
- routes/workflows.js: double-prefix fix — declarations are mount-
  relative (/history before /:workflowId/history); the dashboard's
  single-prefix calls no longer 404 (Premium feature was dead in prod)
- __tests__/mcp/mcp-core-dc166{,-integration}.test.js: tool/schema +
  route-existence verifier (scoped to the 11 new tools; extension to
  all 28 is the MCP truth batch, audit #40)

Merge-commit fixes (judge r1 C -> r2 A, urn:ump:2jdpii43.../5clu4udr...):
1. integration-test header over-claimed COMPLETE tool coverage — scope
   narrowed to the DC-166 additions, stated explicitly
2. routes/workflows.js: shadowed top-level ok import removed (all uses
   inside the factory use deps.ok) + comment documenting the trap

Verified on merged tree: TOOLS.length=28, MCP+workflows 44/44.
Judge A — urn:ump:5clu4udrbwuwxn74tqwxtukfjnrwkrbiykp6uh66ipipzxr32xsq

dashcaddy-api/routes/workflows.js

@@ -1,5 +1,6 @@
 const express = require('express');
-const { ok } = require('../src/utils/responses');
+// NOTE: the success helper is injected via the factory's deps (deps.ok) — a
+// top-level import here would be silently shadowed by the destructured param.
 const { ValidationError } = require('../src/utilities/errors');
 
 /**
@@ -32,15 +33,21 @@ module.exports = function({ workflowEngine, licenseManager, asyncHandler, ok })
   router.use(licenseManager.requirePremium('workflows'));
 
   // ===== WORKFLOW MANAGEMENT ENDPOINTS =====
+  // PATH CONTRACT: mounted at apiRouter.use('/workflows', ...) in src/app.js,
+  // so paths here are RELATIVE to that mount. The previous literal
+  // router.get('/workflows', ...) produced a double prefix
+  // (/api/v1/workflows/workflows/...) that the shipped dashboard bundle
+  // (status/js/bundled-workflows.js calls single-prefix /api/v1/workflows/)
+  // never hits; the DC-166 judge flagged the composed-path mismatch.
 
-  // List all bundled workflows
-  router.get('/workflows', asyncHandler(async (req, res) => {
+  // List bundled workflows
+  router.get('/', asyncHandler(async (req, res) => {
     const workflows = workflowEngine.listWorkflows();
     ok(res, { workflows });
   }, 'workflows-list'));
 
   // Enable a workflow
-  router.post('/workflows/:workflowId/enable', asyncHandler(async (req, res) => {
+  router.post('/:workflowId/enable', asyncHandler(async (req, res) => {
     const { workflowId } = req.params;
     validateWorkflowId(workflowId);
     const result = workflowEngine.setWorkflowEnabled(workflowId, true);
@@ -48,7 +55,7 @@ module.exports = function({ workflowEngine, licenseManager, asyncHandler, ok })
   }, 'workflows-enable'));
 
   // Disable a workflow
-  router.post('/workflows/:workflowId/disable', asyncHandler(async (req, res) => {
+  router.post('/:workflowId/disable', asyncHandler(async (req, res) => {
     const { workflowId } = req.params;
     validateWorkflowId(workflowId);
     const result = workflowEngine.setWorkflowEnabled(workflowId, false);
@@ -56,7 +63,7 @@ module.exports = function({ workflowEngine, licenseManager, asyncHandler, ok })
   }, 'workflows-disable'));
 
   // Manually trigger a workflow
-  router.post('/workflows/:workflowId/run', asyncHandler(async (req, res) => {
+  router.post('/:workflowId/run', asyncHandler(async (req, res) => {
     const { workflowId } = req.params;
     validateWorkflowId(workflowId);
     const triggerData = req.body || {};
@@ -66,20 +73,22 @@ module.exports = function({ workflowEngine, licenseManager, asyncHandler, ok })
     ok(res, { result });
   }, 'workflows-run'));
 
-  // Get execution history for a workflow
-  router.get('/workflows/:workflowId/history', asyncHandler(async (req, res) => {
+  // ALL-history route declared BEFORE /:workflowId/history so the literal
+  // 'history' segment is not captured as a workflowId.
+  // Get all workflow execution history
+  router.get('/history', asyncHandler(async (req, res) => {
+    const limit = parseInt(req.query.limit) || 100;
+    const history = workflowEngine.getHistory(null, limit);
+    ok(res, { history });
+  }, 'workflows-all-history'));
+
+  // Get execution history for one workflow
+  router.get('/:workflowId/history', asyncHandler(async (req, res) => {
     const { workflowId } = req.params;
     const limit = parseInt(req.query.limit) || 50;
     const history = workflowEngine.getHistory(workflowId, limit);
     ok(res, { history });
   }, 'workflows-history'));
 
-  // Get all workflow execution history
-  router.get('/workflows/history', asyncHandler(async (req, res) => {
-    const limit = parseInt(req.query.limit) || 100;
-    const history = workflowEngine.getHistory(null, limit);
-    ok(res, { history });
-  }, 'workflows-all-history'));
-
   return router;
 };