Phase 2: Visibility Filter & Owner ID

- Add OwnedMixin to 15 models (contact_folder, user_preference, workspace,
  mcp_server_config, agent_definition, automation_definition, report_template,
  report_instance, entity_link, comm_conversation, proactive_suggestion,
  ai_agent, ai_chat_session, tag, share_link)
- Migration 0102: Add owner_id column to 15 tables with backfill from user_id
- Fix EntityPermission Registry: remove notification, add entity_attachment,
  entity_history, subtask, calendar, folder; fix wrong class names
  (DmsFile→File, CalendarEvent→CalendarEntry, Mailbox→MailAccount)
- Add apply_visibility_filter to list endpoints in tags, tasks, mcp_client,
  automation, report_generator, ai_assistant routes
- Add owner_id to create handlers for all new OwnedMixin models
- Patch tasks/services.py and automation/services.py list methods with
  user_id and is_system_admin parameters

app/plugins/builtins/mcp_client/models.py

@@ -10,9 +10,10 @@ from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.db import Base, TenantMixin
+from app.models.owned_mixin import OwnedMixin
 
 
-class McpServerConfig(Base, TenantMixin):
+class McpServerConfig(Base, TenantMixin, OwnedMixin):
     """Configuration for an external MCP server — tenant-scoped."""
 
     __tablename__ = "mcp_server_configs"

app/plugins/builtins/mcp_client/routes.py

@@ -12,6 +12,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
+from app.core.visibility import apply_visibility_filter
 from app.deps import get_current_user, require_permission
 from app.plugins.builtins.mcp_client.client import McpClient
 from app.plugins.builtins.mcp_client.models import McpServerConfig as McpServerConfigModel
@@ -50,7 +51,13 @@ async def list_mcp_servers(
     current_user: dict[str, Any] = Depends(require_permission("mcp-client:read")),
 ) -> list[McpServerConfigResponse]:
     """List all configured MCP servers for the current tenant."""
-    stmt = select(McpServerConfigModel).where(McpServerConfigModel.tenant_id == uuid.UUID(current_user["tenant_id"]))
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_system_admin = current_user.get("is_system_admin", False)
+    stmt = select(McpServerConfigModel).where(McpServerConfigModel.tenant_id == tenant_id)
+    stmt = await apply_visibility_filter(
+        db, stmt, "mcp_server_config", McpServerConfigModel, user_id, tenant_id, is_system_admin
+    )
     result = await db.execute(stmt)
     configs = result.scalars().all()
     return [_config_to_response(c) for c in configs]
@@ -71,6 +78,7 @@ async def create_mcp_server(
         enabled=body.enabled,
         description=body.description,
         created_by=uuid.UUID(current_user["user_id"]),
+        owner_id=uuid.UUID(current_user["user_id"]),
     )
     db.add(cfg)
     await db.commit()