feat(mcp): configure enabled tool groups

Add OBSIDIAN_MCP_ENABLED_TOOLS as the service config source for MCP tool groups while keeping OBSIDIAN_MCP_ENABLE_INGEST as a legacy fallback.

Add mcp_service.sh tools list/enable/disable commands, preserve enabled tools across normal start and token rotation, and let start --enable-ingest/--disable-ingest update the same config file.

Teach the MCP runtime to derive file-assets and ingest registration from enabled tool groups so file asset tools can be disabled separately from ingest.

Validation: python3 -m unittest discover -v; python3 -m py_compile scripts/manage_mcp_service.py obsidian_wiki/mcp_server.py tests/test_mcp_service.py tests/test_mcp_server_remote.py; CLI tools enable/disable dry run; git diff --check.

.env.example

@@ -48,6 +48,7 @@ OBSIDIAN_MCP_TOKEN=
 OBSIDIAN_MCP_HOST=127.0.0.1
 OBSIDIAN_MCP_PORT=8765
 OBSIDIAN_MCP_PATH=/mcp
+OBSIDIAN_MCP_ENABLED_TOOLS=file-assets
 
 # Optional write-capable MCP ingest tools. Default is disabled.
 # When enabled, remote MCP clients sharing this token can upload files and
@@ -57,6 +58,8 @@ OBSIDIAN_MCP_PATH=/mcp
 # project wiki-ingest skill without editing files.
 # Keep this runtime root outside OBSIDIAN_VAULT_PATH; uploads are staging inputs,
 # and wiki-ingest decides how sources are archived into the vault.
+# Prefer OBSIDIAN_MCP_ENABLED_TOOLS=file-assets,ingest for new configs. This
+# legacy flag is still read when OBSIDIAN_MCP_ENABLED_TOOLS is absent.
 OBSIDIAN_MCP_ENABLE_INGEST=0
 OBSIDIAN_MCP_INGEST_MAX_FILE_BYTES=104857600
 OBSIDIAN_MCP_INGEST_MAX_CHUNK_BYTES=4194304