feat(mcp): add 18 more live-verified remote MCPs from the final sweep
OAuth+DCR (14): mixpanel, algolia, klaviyo, amplitude, gitlab, circleci,
customer-io, omnisend, motherduck, strava, gamma, craft, wordpress-com,
robinhood (trade-execution caution in post_install)
No-auth (4): kiwi, trivago, alltrails, twilio-docs (search/read-only;
kiwi+trivago link out for booking, no in-conversation payment)
Probed and rejected: expedia, booking, uber, uber-eats, doordash,
instacart, spotify, audible, resy, stubhub, lastminute, coinbase,
posthog, dbt (all OAUTH_NO_DCR on the wire despite directory claims of
DCR); tripadvisor (token-in-URL endpoint); binance, crypto-com,
cash-app (policy: no in-chat trading/checkout beyond robinhood),
autodesk-help (too niche), viator (alltrails preferred)
9a37325717