Keep WebMCP tools stable during live case work - #21

What changed

• keep one browser-facing WebMCP registration alive while React refreshes the underlying board handlers
• add a regression for circle_cards followed by propose_connection through the same registered catalog
• record the external-agent and mobile demo-gate findings

Verified

• 50 tests across 12 files
• npx tsc --noEmit
• production build
• production dependency audit: 0 vulnerabilities
• local browser: one fetched catalog completed group -> connection -> inspect
• local browser: a human approval did not invalidate the fetched catalog
• 390x844: no page-level horizontal overflow

Closes #20