feat(mcp): connect to the official n8n server from the catalog (#116063)

* feat(mcp): add the official n8n server to the catalog

Connect to the user's instance over HTTP with browser OAuth. Keep a
separate n8n-official identifier so the retired n8n bridge is neither
relabeled nor overwritten and retains its credentials and tool filter.

Save ordinary catalog setup values in server config, retaining secret
references in .env. Pass field secrecy through the catalog API so URLs
and client IDs remain visible while credentials stay masked.

Keep the existing install-then-authorize lifecycle. Transactional setup
and cancellation changes are outside this catalog addition.

* refactor(mcp): limit n8n PR to catalog addition

Remove shared installer, storage, field-masking, and input-handler changes.
Those behaviors are being handled in a separate PR. Restore their tests
and Asana guidance to the base branch.

Keep only the official n8n manifest and setup documentation, using the
catalog's existing setup and persistence behavior.

optional-mcps/n8n-official/manifest.yaml

@@ -0,0 +1,37 @@
+manifest_version: 1
+
+# A distinct name keeps the retired n8n stdio bridge's saved configuration intact.
+name: n8n-official
+description: Connect to your n8n instance's official MCP server with browser OAuth.
+source: https://docs.n8n.io/connect/connect-to-n8n-mcp-server/
+
+transport:
+  type: http
+  url: "${N8N_MCP_SERVER_URL}"
+
+auth:
+  type: oauth
+  env:
+    - name: N8N_MCP_SERVER_URL
+      prompt: "MCP Server URL (n8n Settings > Instance-level MCP > Connect; ends in /mcp-server/http)"
+      required: true
+      secret: false
+
+post_install: |
+  In n8n Settings > Instance-level MCP, enable MCP access (owner or admin).
+  Open Connect and copy the full Server URL ending in /mcp-server/http.
+  Use that URL, not your editor URL. The Hermes backend must be able to reach it.
+  On older n8n versions, the same endpoint is shown in the MCP settings page.
+
+  Run `hermes mcp login n8n-official`, or use Authorize in the desktop app
+  or dashboard, and approve access in n8n. No n8n API key is required.
+  If your instance restricts OAuth callback URLs, allow the callback used by Hermes.
+
+  n8n controls access through your account permissions and MCP settings.
+  Search can show previews of workflows you can view; enable Available in MCP
+  for workflows you want to inspect fully, execute, or modify. Tool availability
+  depends on your n8n version and permissions. Some tools change or run workflows.
+  Use `hermes mcp configure n8n-official` to review the discovered tools.
+
+  Existing n8n bridge connections are unchanged. This is a separate connection,
+  not an automatic migration. Start a new session or use /reload-mcp after setup.

website/docs/user-guide/features/mcp.md

@@ -99,6 +99,30 @@ Catalog entries can require:
 - **OAuth** (third-party provider like Google/GitHub) — Hermes points you at
   `hermes auth <provider>` if you haven't authenticated already.
 
+### n8n's official MCP server
+
+The `n8n-official` catalog entry connects directly to your n8n Cloud or
+self-hosted instance over HTTP with browser OAuth. No local bridge or n8n
+API key is required.
+
+1. Ask an owner or admin to enable **Settings > Instance-level MCP** in n8n.
+2. Open **Connect** and copy the full **Server URL** ending in
+   `/mcp-server/http`, not the editor URL. Older versions show the endpoint
+   directly on the MCP settings page.
+3. Run `hermes mcp install n8n-official` and enter that URL when prompted.
+4. Complete browser OAuth. If needed, run `hermes mcp login n8n-official`
+   or use **Authorize** on the configured server in Desktop or the dashboard.
+5. Review tools with `hermes mcp configure n8n-official`, then start a new
+   session or use `/reload-mcp`.
+
+The Hermes backend must be able to reach the URL. n8n controls permissions
+and workflow exposure; some tools modify or run workflows. See
+[n8n's connection guide](https://docs.n8n.io/connect/connect-to-n8n-mcp-server/).
+
+This entry uses the existing catalog setup and storage behavior. It is
+separate from the retired `n8n` bridge, so existing connections, credentials,
+installed files, and tool selections are not replaced.
+
 ### Tool selection at install time
 
 After credentials are configured, Hermes probes the MCP server to list every