Allow guest access to the MCP endpoint when an OIDC Provider is installed

The PR (#33) was merged as-is and the ticket's scope was widened with follow-up commits on top of it:

• allowGuest is the single gate for unauthenticated callers, with or without an OIDC Provider. Previously, without a provider, guests were always served; they are now refused (401) until the flag is on. The Bearer challenge with the RFC 9728 metadata is only sent when a provider is installed; otherwise the 401 carries no challenge, like the platform's own REST resources. Upgrade note: installs without a provider that served guests must tick the box after upgrading.
• A guest request that presents an Authorization header is always refused, so an expired or invalid token is not silently served as guest.
• Guests are served a tool catalog without the authoring tools (tools/list and man), backed by a separate cached server variant per wiki; the call-time refusal stays as defence in depth.
• Guests get no unfiltered counts: query_documents hides the pre-rights-filter match total (an anonymous term-existence oracle; the platform REST search returns none) and get_schema lists classes without instance counts. Authenticated callers are unchanged.
• The wiki id in the URL must be the exact id of an existing wiki; case variants of the main wiki id used to be served under their own cache key and now answer 404.
• Admin UI: the checkbox is shown on subwikis next to "enabled"; the main wiki is controlled from the farm dashboard, which gained a "Guest access" column (new mcp script-service methods, admin right on the wiki).
• get_tree survey: a space line only carries its WebHome reference when the caller may view it, and partly denied spaces now list their viewable pages, removing a dead end for callers with page-level rights.