feat(mcp-gateway): register the MCP page icons

Snapshot of in-flight work in this checkout: the shared page-icon map gains the
MCP entries so the console's MCP pages render a glyph rather than the fallback.

# Why this cannot merge alone

src/shared/ui/page-icon-parity.test.ts reads ACROSS the repository boundary —
it opens ../../aikey-control-master/web/src/layouts/AppShell.tsx — and requires
every page-icons entry to name the same glyph the shell's nav item renders. It
exists because /user/virtual-keys once showed a crowd in the nav and a key in
its own header: nothing was broken, the two sides simply had no reason to agree.

aikey-control-master's MCP surface PR modifies that AppShell. So these two
changes are one change wearing two repositories, and merging either half alone
is what turns this fence red.

Verified here rather than assumed: the fence passes against both working trees
as they stand (3/3).

⚠️ page-icons.ts is byte-identical in the two repositories, but NOTHING compares
the two copies to each other — the CI mirror-drift check covers only
web/src/shared/generated/provider-registry.ts. The copies can drift silently.
Recorded, not fixed here.

⚠️ node_modules/ is NOT gitignored in this repository and was excluded by hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: 2 people

web/src/shared/ui/page-icons.ts

@@ -30,6 +30,8 @@ const USER_PAGE_GLYPH: Record<string, GlyphName> = {
   'access-tokens': 'token-tally',
   'account': 'user',
   'apps': 'puzzle',
+  // 阶段8 P8 — the member's read-only MCP tool list.
+  'mcp-tools': 'puzzle',
   'compliance': 'scale',
   'invites': 'user-plus',
   'overview': 'overview',
@@ -72,6 +74,15 @@ const MASTER_PAGE_GLYPH: Record<string, GlyphName> = {
   // individual roster) sitting directly beneath it in the same group.
   'directory': 'team-kind',
   'nodes': 'server',
+  // MCP gateway (阶段8 P8). The glyphs mirror the sidebar exactly — that is the
+  // whole point of this table — and the split follows what each page IS:
+  // backends are the third-party pieces plugged in ('puzzle'), a toolset is a
+  // bundle ('layers', like the other grouping surfaces), a grant is an access
+  // decision ('key'), and the call log is an audit surface ('usage-audit').
+  'mcp-backends': 'puzzle',
+  'mcp-toolsets': 'layers',
+  'mcp-grants': 'key',
+  'mcp-audit': 'usage-audit',
   'oauth-groups': 'layers',
   'packs': 'library',
   'provider-accounts': 'cloud',
@@ -83,6 +94,12 @@ const MASTER_PAGE_GLYPH: Record<string, GlyphName> = {
   'virtual-keys': 'key',
   // 无导航项的页面：继承语义最近的父级章节图标
   'mock-provider': 'bot',
+  // The API importer has no sidebar entry — it is reached from the backends
+  // page, because importing is something you do TO a backend you just made.
+  'mcp-import': 'puzzle',
+  // The member's own MCP tool list has no master nav entry; it lives in the
+  // user console and inherits the same 'puzzle' the backends page uses.
+  'mcp-tools': 'puzzle',
   'settings': 'settings',
   'triage': 'scale',
   'unpriced-models': 'master-gauge',