Add read-only Forge session MCP server

[eshulman2]

Summary

• add a read-only Forge session summary service backed by checkpoint state
• expose production HTTP endpoint: GET /api/v1/sessions/{ticket_key}/summary
• expose a user-facing stdio MCP server for session and observability inspection
• keep forge-session-mcp out of the checked-in mcp-servers.json so Forge agents do not load session-inspection tools themselves
• add GRAFANA_BASE_URL config so summaries can include dashboard links
• add user docs for the HTTP endpoint and optional Claude/MCP setup

Observability Data Layer

• add Langfuse API-backed observability endpoints under /api/v1/observability/*
• expose safe aggregate tools for ticket cost/tokens/latency, model usage, workflow funnel, and metadata coverage
• expose explicit full-trace access through:
  • GET /api/v1/observability/tickets/{ticket_key}/traces
  • GET /api/v1/observability/traces/{trace_id}
  • MCP tools get_session_traces and get_trace
• avoid direct ClickHouse access from Forge API/MCP; Grafana can still use ClickHouse, but the user data layer goes through Langfuse APIs

Safety

• users can query Forge API or their own assistant MCP client instead of needing Redis, Langfuse, Grafana, or ClickHouse credentials
• session summaries and aggregate observability responses intentionally omit raw prompts, model messages, generated artifacts, tool inputs, and raw trace payloads
• full trace tools are explicit and return full_trace_data_exposed: true
• HTTP session summaries default to checkpoint-derived summary only; Redis logs are opt-in on the HTTP endpoint and bounded by logs_limit <= 50
• the MCP server is configured by users in their assistant client, not by Forge's agent MCP configuration

Docs

• document /api/v1/sessions/{ticket_key}/summary in the API reference
• document observability aggregate and full-trace endpoints in the API reference
• add docs/reference/session-inspection.md with HTTP and Claude MCP setup instructions
• link session inspection from README, docs index, and configuration reference

Tests

• jq empty mcp-servers.json
• UV_CACHE_DIR=/tmp/uv-cache uv run ruff check src/forge/observability/access.py src/forge/api/routes/observability.py src/forge/mcp/session.py src/forge/api/routes/__init__.py src/forge/main.py tests/unit/observability/test_access.py tests/unit/api/routes/test_observability.py tests/unit/mcp/test_session_server.py
• UV_CACHE_DIR=/tmp/uv-cache uv run pytest tests/unit/observability/test_access.py tests/unit/api/routes/test_observability.py tests/unit/mcp/test_session_server.py tests/unit/api/routes/test_sessions.py tests/unit/sessions/test_summary.py
• live gateway smoke checks for health, session summary, observability health, ticket observability, ticket traces, model usage, and workflow funnel