powerlab-mcp: real (non-SDK) MCP-client interop test

[neochaotic]

Current integration tests use the official SDK's own client (in-process + HTTP). That proves protocol correctness but not interop with a real external client (Claude Desktop / Cursor) over HTTP+JWT. Add a live smoke on host .142 (and/or a contract test) exercising a real MCP client reading system:// and journal:// over the gated HTTP transport. Auth-over-LAN currently only joins the transport on real hardware.

Also: confirm the official go-sdk's resource-subscription support before the install-log streaming block.

[neochaotic]

Live smoke ran 4/5 green on .142 (m900) — system:// + journal:// work over the real HTTP+MCP stack against the official client. Only audit:// failed and only due to filesystem perms on the gateway's audit.jsonl (root:root 0600 vs ad-hoc smoke as neochaotic). The code path is proven via the integration test; the perm decision is captured in #599. Closing the test-via-real-client gap for system/journal.

[neochaotic]

Full live smoke now ✅ on .142 (m900) over the real HTTP + Streamable transport via the official MCP SDK client: system://metrics (mem/load/uptime), journal://core?lines=3 (3 real entries), and audit://recent?limit=3 (3 real records read from /var/log/powerlab/audit.jsonl, server run under sudo to satisfy the root:root 0600 file). All three resources discovered via resources/list and read end-to-end. Remaining gap = a non-SDK pairing test (Claude Desktop) — same wire protocol, but the UX pairing flow is separate.