docs(mcp): MCP section in README + CLAUDE.md (TASK-949) (#339)

* docs(mcp): add MCP section to README + CLAUDE.md (TASK-949)

Closes PLAN-942's docs task. The pad-web /mcp/local guide
(see PerpetualSoftware/pad-web PR #41) is the canonical reference;
this commit adds:

- README.md "Optional — connect a desktop AI app via MCP" subsection
  under Getting Started, with the one-line install + link to the
  full guide.

- CLAUDE.md "MCP server" section between "CLI" and "Data Model",
  documenting the surface (tools / resources / prompts) so agents
  working in pad's own repo know it exists and where the code lives.

No code changes; this PR is documentation-only. Companion to
PerpetualSoftware/pad-web PR #41 (the public guide).

Parent: PLAN-942.

* docs(mcp): clarify MCP tool surface excludes interactive commands (Codex round 1)

Codex flagged: README claimed clients can call "every pad command as
a tool", but internal/mcp/registry.go's DefaultExcludes list strips
~20 commands (auth setup/login/logout, db ops, init, item edit,
project watch, workspace init/import/export/onboard/join, server
start/stop, mcp serve/install, completion). The blanket "every"
phrasing would mislead users.

Reworded to "non-interactive pad commands" with concrete examples
of both included (item CRUD, project intelligence, search) and
excluded (auth setup, db restore, init, item edit) categories. Full
list still lives in CLAUDE.md and the /mcp/local guide.

Parent: PLAN-942.

* docs(mcp): tighten CLAUDE.md MCP overview to mention the exclude list (Codex round 2)

Codex round 2: same overstatement that round 1 caught in README also
sat in CLAUDE.md's opening paragraph ("every pad command", "any new
pad command lands as an MCP tool for free"). The bullet under the
Surface header already qualified it, but the lead sentence framed
auto-generation as unconditional. Reworded to "non-interactive pad
commands" + "any new pad command that isn't on internal/mcp.DefaultExcludes"
so the overview matches the bullet — and the docs match what the
code actually does.

Parent: PLAN-942.

* docs(mcp): replace 'every / for free' framing with explicit review gate (Codex round 3)

Codex round 3 still flagged "every leaf pad command" + "any new
command lands as an MCP tool for free" — concerned the language
implies auto-registration without human review. The behavior IS
auto-registration, but the docs now make the human-review step
explicit: when adding a pad command, decide whether it belongs on
MCP and add to DefaultExcludes if not.

Reworded the opening overview AND the bullet:
- Lead now says "derived from the cmdhelp Document and filtered
  against internal/mcp.DefaultExcludes" with the concrete strip list.
- New bold sentence: "When adding a new pad command, decide whether
  it belongs on the MCP surface" + criteria for when to exclude.
- Bullet now says "leaf pad commands not in DefaultExcludes (the
  per-PR review gate above)".

Same behavior, more honest framing about what the developer needs
to think about.

Parent: PLAN-942.

CLAUDE.md

@@ -173,6 +173,26 @@ pad workspace join <code>     # Accept workspace invitation
 
 Collection names accept singular forms: `task`→`tasks`, `idea`→`ideas`, `doc`→`docs`.
 
+## MCP server
+
+Pad runs as a local Model Context Protocol server so Claude Desktop / Cursor / Windsurf can call non-interactive `pad` commands as tools. The surface is derived from the cmdhelp Document (`pad help --format json`) and filtered against `internal/mcp.DefaultExcludes` (which strips interactive / destructive commands — `auth setup/login`, `db backup/restore`, `init`, `item edit`, `project watch`, `workspace export/import`, `mcp serve/install`, `completion`, etc.).
+
+**When adding a new `pad` command, decide whether it belongs on the MCP surface.** If it's interactive (prompts the user), destructive (mutates auth / filesystem state), long-running (streaming watcher), or recursive (would spawn another MCP server), add it to `DefaultExcludes` in `internal/mcp/registry.go`. Otherwise it's safe to expose, and the registry picks it up automatically.
+
+```bash
+pad mcp serve                 # JSON-RPC over stdio (called by clients)
+pad mcp install <client>      # Write the client's mcp.json entry
+pad mcp uninstall <client>    # Remove the entry
+pad mcp status                # Install state across supported clients
+```
+
+Surface:
+- **Tools:** leaf `pad` commands not in `DefaultExcludes` (the per-PR review gate above). Plus `pad_set_workspace` for the session default.
+- **Resources:** `pad://workspace/{ws}/items/{ref}`, `pad://workspace/{ws}/items`, `pad://workspace/{ws}/dashboard`, `pad://workspace/{ws}/collections`.
+- **Prompts:** `pad_plan`, `pad_ideate`, `pad_retro`, `pad_onboard` — multi-step workflows lifted from `skills/pad/SKILL.md`.
+
+Code lives in `internal/mcp/` (built on `github.com/mark3labs/mcp-go`). Public docs at `getpad.dev/mcp/local`.
+
 ## Data Model
 
 - **Collections** have JSON schemas defining typed fields (select, text, date, number, etc.)

README.md

@@ -232,6 +232,22 @@ pad library list --type conventions  # Pre-built conventions you can adopt
 pad library list --type playbooks    # Pre-built multi-step workflows
 ```
 
+### 4. Optional — connect a desktop AI app via MCP
+
+Pad ships an MCP (Model Context Protocol) server so Claude Desktop, Cursor, or
+Windsurf can call non-interactive `pad` commands as tools (item CRUD, project
+intelligence, search, etc. — not destructive / lifecycle ones like `auth setup`,
+`db restore`, `init`, `item edit`), read items and the dashboard by URL, and
+load multi-step workflows as prompts.
+
+```bash
+pad mcp install claude-desktop   # or: cursor, windsurf, --all
+# Restart the client; pad shows up as the "pad" MCP server.
+```
+
+Full guide at [getpad.dev/mcp/local](https://getpad.dev/mcp/local) — install
+paths, available tools/resources/prompts, troubleshooting.
+
 ## CLI Reference
 
 ```