fix: patch all four critical security vulnerabilities (C1–C4) — dev → main (#23) * fix: update explore audio-preview test to match SSR template * fix: drop CSR-only loadExplore/DISCOVER_API assertions from explore grid test * feat: MCP 2025-11-25 — Elicitation, Streamable HTTP, docs & test fixes - Full MCP 2025-11-25 Streamable HTTP transport (GET/DELETE /mcp, session management, Origin validation, SSE push channel, elicitation) - 5 new elicitation-powered tools: compose_with_preferences, review_pr_interactive, connect_streaming_platform, connect_daw_cloud, create_release_interactive - 2 new prompts: musehub/onboard, musehub/release_to_world - Session layer (session.py), SSE utils (sse.py), ToolCallContext (context.py), elicitation schemas (elicitation.py) - Elicitation UI routes and templates for OAuth URL-mode flows - Updated ElicitationAction/Request/Response/SessionInfo types in mcp_types.py - Updated README, docs/reference/mcp.md, docs/reference/type-contracts.md to reflect MCP 2025-11-25 throughout (32 tools, 8 prompts, new sections for session management, elicitation, Streamable HTTP) - Fix: add issue-preview CSS + bodyPreview JS to issue_list.html template; add body snippet to issue_row macro - Fix: test_mcp_musehub updated for elicitation category and 32-tool count - Fix: ui_mcp_elicitation added to _DIRECT_REGISTERED in routes __init__ to prevent double-registration and duplicate OpenAPI operation IDs - Fix: aiosqlite datetime DeprecationWarning suppressed in pyproject.toml - 89 MCP tests + 2145 total tests passing, 0 warnings Co-authored-by: Gabriel Cardona * fix: resolve all mypy type errors to get CI green - Extend MusehubErrorCode with elicitation-specific codes (elicitation_unavailable, elicitation_declined, not_confirmed) - Change private enum lists in elicitation.py to list[JSONValue] so they satisfy JSONObject value constraints without cast() - Fix sse.py notification/request/response builders to use dict[str, JSONValue] locals, eliminating all type: ignore comments - Add JSONValue import to sse.py and context.py; remove stale Any import - Thread JSONObject through session.py (MCPSession.client_capabilities, MCPSession.pending Future type, create_session / resolve_elicitation signatures) for consistency - Fix mcp.py route: AsyncIterator return on generators, narrow req_id to str | int | None before passing to sse_response, use JSONObject for client_caps, remove unused type: ignore - Fix elicitation_tools.py: annotate chord/section lists as list[JSONValue], narrow JSONValue prefs fields with str()/isinstance() before use, fix _daw_capabilities return type, remove erroneous await on sync _check_db_available(), remove all json_list() usage - Add isinstance guards in ui_mcp_elicitation.py slug-map comprehensions * refactor: separation of concerns — externalize all CSS/JS from templates CSS: - Extract shared UI patterns from inline