feat: add MCP research access and browser key management

backend/app/models.py

@@ -494,3 +494,49 @@ class ResearchStepRun(Base):
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=now)
     updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=now)
     __table_args__ = (UniqueConstraint("run_id", "node_id", "round"),)
+
+
+class MCPToken(Base):
+    """Revocable personal tokens; only the one-way digest is persisted."""
+
+    __tablename__ = "mcp_tokens"
+    id: Mapped[str] = mapped_column(String(36), primary_key=True)
+    token_hash: Mapped[str] = mapped_column(String(64), unique=True)
+    name: Mapped[str] = mapped_column(String(100))
+    admin_id: Mapped[int] = mapped_column(ForeignKey("admins.id"))
+    account_id: Mapped[int] = mapped_column(ForeignKey("accounts.id"))
+    wq_user_id: Mapped[str] = mapped_column(String(100))
+    scopes: Mapped[list] = mapped_column(JSON)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=now)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), index=True)
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+
+
+class ResearchRequest(Base):
+    """Successful atomic operations survive retries and credential rotation."""
+
+    __tablename__ = "research_requests"
+    id: Mapped[str] = mapped_column(String(36), primary_key=True)
+    account_id: Mapped[int] = mapped_column(ForeignKey("accounts.id"))
+    operation: Mapped[str] = mapped_column(String(50))
+    idempotency_key: Mapped[str] = mapped_column(String(100))
+    digest: Mapped[str] = mapped_column(String(64))
+    business_id: Mapped[str] = mapped_column(String(36))
+    response: Mapped[dict] = mapped_column(JSON)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=now)
+    __table_args__ = (UniqueConstraint("account_id", "operation", "idempotency_key"),)
+
+
+class MCPAudit(Base):
+    """Minimal call evidence, never raw arguments or authentication material."""
+
+    __tablename__ = "mcp_audits"
+    id: Mapped[str] = mapped_column(String(36), primary_key=True)
+    token_id: Mapped[str] = mapped_column(ForeignKey("mcp_tokens.id"), index=True)
+    tool: Mapped[str] = mapped_column(String(100))
+    request_id: Mapped[str] = mapped_column(String(100))
+    input_digest: Mapped[str] = mapped_column(String(64))
+    business_id: Mapped[str | None] = mapped_column(String(100))
+    result_code: Mapped[str] = mapped_column(String(60))
+    elapsed_ms: Mapped[int] = mapped_column(Integer)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=now, index=True)