feat: add opt-in MCP transport tracing - #48

Summary

• add opt-in MCP transport/session/request tracing gated by CODER_MCP_TRACE_ENABLED
• add CODER_MCP_TRACE_RETENTION_HOURS with a 24-hour default and dbpurge cleanup
• trace the MCP HTTP lifecycle from early ingress through auth, transport parse/dispatch, tool handler, response writes, cancellation, and completion
• persist long-lived GET stream connection lifecycle separately from MCP session registration lifecycle
• expose X-Coder-MCP-Trace-Id for cross-correlation with edge/Caddy logs
• keep trace writes off the MCP request critical path via a bounded best-effort async writer
• avoid storing request payloads, auth headers, tokens, stdin, env, or tool output
• stop recent_activity from self-recording in the activity list it reads

Validation

• full-stack MCP trace E2E against embedded PostgreSQL
• MCP package tests
• coderd trace middleware tests
• deployment option/default/validation tests
• DB trace lifecycle + retention tests
• dbpurge tests
• migration fixture suite
• database gentest
• race detector on trace middleware/MCP lifecycle
• git diff --check

Operational defaults

• tracing disabled by default
• retention defaults to 24 hours
• dbpurge runs at startup and every 10 minutes