[FEATURE]: Delivery story - MCP Apps complex extension implementation

[vishu-bh]

Parent epic: #2527

Groups implementation checkpoints: #4968, #4969, #4970, #4971, #4972

User Story

As an MCP Apps user and security administrator, I want the existing MCP Apps work from #5079 to plug into the generic extension governance framework so that interactive ui:// resources and app-originated calls inherit the same policy, plugin, sanitizer, and audit controls as future extensions.

One-Week Deliverable

Refactor or integrate MCP Apps as the first complex extension under the generic governance layer, preserving #5079 behavior while centralizing common extension controls.

Scope

• Register MCP Apps as io.modelcontextprotocol/ui in the generic extension registry.
• Store and serve ui:// resources through governed MCP resource flows.
• Associate tools with _meta.ui.resourceUri and model/app visibility policy.
• Authorize AppBridge same-server tool/resource calls through generic extension policy plus MCP Apps-specific rules.
• Enforce CSP, sandbox, allowed-origin, permissions policy, external navigation, and linkout policy.
• Add focused security regression coverage and demo fixtures.

Security Requirements

• MCP Apps must not remain a separate special-case island after the framework exists.
• Generic extension policy must run before MCP Apps handler behavior.
• App-originated calls are a distinct security surface and require same-server session binding, app-visible tool policy, RBAC, token scoping, plugin approval, sanitizer handling, and audit.
• External navigation and external network access are blocked by default unless explicitly allowlisted, host-mediated, or rewritten through a governed ContextForge path.
• CSP/sandbox/permissions policy must be gateway-enforced and must not blindly trust upstream declarations.

Acceptance Criteria

• Authorized callers can register/read a ui:// resource only when MCP Apps is enabled and advertised through policy.
• Tool metadata can point to a ui:// resource.
• App-only tools are hidden from model-facing tools/list but callable from an authorized app session.
• Cross-server app calls, expired sessions, wrong team, disabled extension, public-only callers, hidden gateways, and insufficient permissions are denied and audited.
• CSP/sandbox/permissions/external-navigation policy is validated and surfaced to the host/rendering path.
• Targeted regression tests cover generic extension routing plus MCP Apps deny paths.

Demo

Register ui://dashboard, invoke a UI-associated tool, perform an allowed same-server app call, then show a cross-server app call and an external-navigation attempt denied with audit evidence.