canonical-vault-mcp-server: see /api/mcp