ungated-global: system project whose servers ride every project, pre-gate

New seed-once system project `ungated-global`: every server attached to it
is merged into every project's MCP endpoint in front of the gate (listed
and callable before begin_session), and its project prompt is prepended to
every project's instructions.

- mcpd: bootstrapUngatedGlobal seeds the project once-ever (marker key
  `ungatedGlobalSeeded` in mcpctl-system-settings), with default server
  `calcmcp` (patched CalcMCP fork, mysources.co.uk/michal/calcmcp:1.1.0)
  and a "never do math yourself, always use calcmcp" prompt. Deletions are
  durable: `mcpctl delete server calcmcp -p ungated-global` stays deleted.
- mcpd: GET /projects/:id/servers appends global servers flagged
  `ungatedGlobal: true` (direct attachment wins, no self-merge);
  GET /projects/:id/instructions prepends the global prompt and lists the
  global servers.
- mcplocal: discovery surfaces the flagged names; the gate plugin exempts
  them — gated tools/list returns begin_session + exempt tools, calls to
  them pass through without ungating, and initialize instructions list
  them under "Available immediately (no begin_session required)".
- templates/calcmcp.yaml so a deleted default can be re-created by hand.
- docs/ungated-global.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/mcpd/tests/project-routes.test.ts

@@ -345,4 +345,78 @@ describe('Project Routes', () => {
       expect(body.serverOverrides).toEqual({ ha: { proxyModel: 'ha-special' } });
     });
   });
+
+  describe('ungated-global merge', () => {
+    const mkPs = (id: string, name: string, description = '') =>
+      ({ id: `ps-${id}`, projectId: 'x', serverId: id, createdAt: new Date(), server: { id, name, description } }) as never;
+
+    function repoWithGlobal(ownServers: never[] = []) {
+      const repo = mockProjectRepo();
+      vi.mocked(repo.findById).mockImplementation(async (id: string) =>
+        id === 'p1' ? makeProject({ id: 'p1', name: 'my-proj', prompt: 'own prompt', servers: ownServers }) : null);
+      vi.mocked(repo.findByName).mockImplementation(async (name: string) => {
+        if (name === 'ungated-global') {
+          return makeProject({
+            id: 'p-ug',
+            name: 'ungated-global',
+            prompt: 'Always use calcmcp for math.',
+            gated: false,
+            servers: [mkPs('srv-calc', 'calcmcp', 'scientific calculator')],
+          });
+        }
+        return null;
+      });
+      return repo;
+    }
+
+    it('GET /servers appends global servers flagged ungatedGlobal', async () => {
+      await createApp(repoWithGlobal([mkPs('srv-ha', 'ha')]));
+      const res = await app.inject({ method: 'GET', url: '/api/v1/projects/p1/servers' });
+      expect(res.statusCode).toBe(200);
+      const body = res.json<Array<{ name: string; ungatedGlobal?: boolean }>>();
+      expect(body.map((s) => s.name)).toEqual(['ha', 'calcmcp']);
+      expect(body[0]!.ungatedGlobal).toBeUndefined();
+      expect(body[1]!.ungatedGlobal).toBe(true);
+    });
+
+    it('GET /servers does not duplicate a server also attached directly', async () => {
+      await createApp(repoWithGlobal([mkPs('srv-calc', 'calcmcp')]));
+      const res = await app.inject({ method: 'GET', url: '/api/v1/projects/p1/servers' });
+      const body = res.json<Array<{ name: string; ungatedGlobal?: boolean }>>();
+      expect(body).toHaveLength(1);
+      expect(body[0]!.name).toBe('calcmcp');
+      expect(body[0]!.ungatedGlobal).toBeUndefined();
+    });
+
+    it('GET /servers on ungated-global itself does not self-merge', async () => {
+      const repo = repoWithGlobal();
+      vi.mocked(repo.findById).mockImplementation(async (id: string) =>
+        id === 'p-ug'
+          ? makeProject({ id: 'p-ug', name: 'ungated-global', servers: [mkPs('srv-calc', 'calcmcp')] })
+          : null);
+      await createApp(repo);
+      const res = await app.inject({ method: 'GET', url: '/api/v1/projects/p-ug/servers' });
+      const body = res.json<Array<{ name: string }>>();
+      expect(body).toHaveLength(1);
+    });
+
+    it('GET /instructions prepends the global prompt and lists global servers', async () => {
+      await createApp(repoWithGlobal([mkPs('srv-ha', 'ha', 'home assistant')]));
+      const res = await app.inject({ method: 'GET', url: '/api/v1/projects/p1/instructions' });
+      expect(res.statusCode).toBe(200);
+      const body = res.json<{ prompt: string; servers: Array<{ name: string }> }>();
+      expect(body.prompt).toBe('Always use calcmcp for math.\n\nown prompt');
+      expect(body.servers.map((s) => s.name)).toEqual(['ha', 'calcmcp']);
+    });
+
+    it('GET /servers is unchanged when ungated-global does not exist', async () => {
+      const repo = mockProjectRepo();
+      vi.mocked(repo.findById).mockImplementation(async (id: string) =>
+        id === 'p1' ? makeProject({ id: 'p1', name: 'my-proj', servers: [mkPs('srv-ha', 'ha')] }) : null);
+      await createApp(repo);
+      const res = await app.inject({ method: 'GET', url: '/api/v1/projects/p1/servers' });
+      const body = res.json<Array<{ name: string }>>();
+      expect(body.map((s) => s.name)).toEqual(['ha']);
+    });
+  });
 });