feat(api): comprehensive Virtual Meta-Server with 12 meta-tools

Implements the Virtual Meta-Server feature (#2230) — a tool aggregation
layer that enables AI agents to discover and invoke thousands of underlying
tools through a unified interface.

Meta-tools:
- search_tools: hybrid semantic + keyword search with scope filtering
- list_tools: paginated tool listing with sorting and filtering
- describe_tool: detailed tool info with schema and metadata
- execute_tool: tool execution with JSON schema validation and routing
- get_tool_categories: aggregated categories with counts
- get_similar_tools: vector similarity search for related tools
- authorize_gateway: interactive OAuth authorization with token refresh
- authorize_all_gateways: one-click authorization for all OAuth gateways
- list_resources: paginated MCP resource listing
- read_resource: read MCP resource content by URI
- list_prompts: paginated MCP prompt listing
- get_prompt: prompt template retrieval with optional rendering

Features:
- OAuth integration: propagates user identity through the call chain
- Chained OAuth flow: authorize-all endpoint chains multiple gateways
- camelCase normalization for MCP clients
- Flat argument tolerance for Copilot Studio
- Post-login redirect via cookie with safe path validation
- Observability: prompt.render and resource.read spans
- JSON serialization: orjson.dumps() for proper JSON output
- Admin UI: meta-server checkbox and hide-underlying-tools in server forms
- Preserves protect_oauth_config_for_storage() on server update
- RBAC enforcement via middleware on all meta endpoints

Closes #2230
Supersedes #3653

Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>

Author: Olivier Gintrand

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 1.0.0-RC-3
+current_version = 1.0.0-RC-2
 commit = False
 tag = False
 sign-tags = True
@@ -24,23 +24,3 @@ replace = version="{new_version}"
 [bumpversion:file:pyproject.toml]
 search = version = "{current_version}"
 replace = version = "{new_version}"
-
-[bumpversion:file:Containerfile.scratch]
-search = version="{current_version}"
-replace = version="{new_version}"
-
-[bumpversion:file:tools_rust/wrapper/Cargo.toml]
-search = version = "{current_version}"
-replace = version = "{new_version}"
-
-[bumpversion:file(chart-version):charts/mcp-stack/Chart.yaml]
-search = version: {current_version}
-replace = version: {new_version}
-
-[bumpversion:file(chart-appversion):charts/mcp-stack/Chart.yaml]
-search = appVersion: "{current_version}"
-replace = appVersion: "{new_version}"
-
-[bumpversion:file:SECURITY.md]
-search = **Current Version: {current_version}**
-replace = **Current Version: {new_version}**

.env.example

@@ -872,15 +872,6 @@ OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
 # Default: 10000 characters
 # MAX_PARAM_LENGTH=10000
 
-# CWE-400: Limits for user-supplied meta_data forwarded to upstream MCP servers.
-# Keeps arbitrarily large dicts from amplifying into downstream network/DB load.
-# Maximum number of top-level keys in meta_data (default: 16)
-# META_MAX_KEYS=16
-# Maximum nesting depth in meta_data (default: 2)
-# META_MAX_DEPTH=2
-# Maximum JSON-encoded byte size of meta_data (default: 4096)
-# META_MAX_BYTES=4096
-
 # Regex patterns for dangerous input (JSON array)
 # Used to detect and block malicious input patterns
 # Default patterns:

.github/workflows/linting-full.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.26.2"
+          go-version: "1.25.8"
           cache-dependency-path: |
             a2a-agents/go/a2a-echo-agent/go.sum
             mcp-servers/go/benchmark-server/go.sum