fix(server): mcp api visibility (#15247)

fix #15246


#### PR Dependency Tree


* **PR #15247** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved consistency when issuing and validating MCP credential tokens
by using a shared token prefix across issuance and parsing.
* Preserved correct recognition of standard JWT-based authentication
tokens.

* **Tests**
* Updated MCP credentials coverage to validate behavior through the HTTP
API response (instead of direct controller invocation).
* Adjusted workspace quota e2e setup to derive restricted limits via
entitlements before reconciling quota state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/core/auth/access-token.ts

@@ -115,7 +115,3 @@ export class AccessTokenService {
     };
   }
 }
-
-export function isLikelyJwt(token: string) {
-  return token.split('.').length === 3;
-}

packages/backend/server/src/core/auth/guard.ts

@@ -23,16 +23,13 @@ import {
   UnsupportedClientVersion,
 } from '../../base';
 import { WEBSOCKET_OPTIONS } from '../../base/websocket';
-import {
-  AccessTokenService,
-  isLikelyJwt,
-  SessionAccessTokenError,
-} from './access-token';
+import { AccessTokenService, SessionAccessTokenError } from './access-token';
 import { AuthSessionService } from './auth-session';
 import { extractTokenFromHeader } from './input';
 import { AuthService } from './service';
 import { AuthSessionPrincipal, Session } from './session';
 import { AuthSessionHttpError } from './session-exchange';
+import { isLikelyJwt } from './token';
 
 const PUBLIC_ENTRYPOINT_SYMBOL = Symbol('public');
 const INTERNAL_ENTRYPOINT_SYMBOL = Symbol('internal');

packages/backend/server/src/core/auth/token.ts

@@ -0,0 +1,8 @@
+export const MCP_CREDENTIAL_TOKEN_PREFIX = 'aff_mcp_v1';
+
+export function isLikelyJwt(token: string) {
+  return (
+    !token.startsWith(`${MCP_CREDENTIAL_TOKEN_PREFIX}.`) &&
+    token.split('.').length === 3
+  );
+}