fix(mcp): refuse panel requests to routes reached through a dot suffix

The server routes a mounted path when a dot follows it, so /mcp.json reached
the MCP endpoint while panel_request refused only /mcp and /mcp/...; the same
held for the provider-settings, credential and model routes. The refusals now
match a dot after the route as well. A regression test drives panel_request
against a real Vite server.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/TOOLS.md

@@ -136,7 +136,7 @@ map imagery, tiles and fonts load directly, from the providers the
 resource's `csp` lists. `panel_request` refuses Provider Settings
 (`/api/setup`), credential and model endpoints (`/api/realtime`,
 `/api/openai`), `/mcp` and the development server's internal routes, in any
-letter case or encoding.
+letter case, encoding or dot suffix.
 
 The panel loads the app's panel build, which `npm run build:panel` writes to
 `dist/panel` and the servers serve at `/panel/`: one app script, one