fix: configure Doable MCP during plugin install

[alphali]

Summary

A first-time coding-agent user could paste a Code Context prompt but still had to configure the Doable MCP separately. The plugin now declares the official hosted MCP endpoint for Codex, Claude Code, and Cursor. Cursor requires DOABLE_API_KEY during installation; Codex and Claude Code resolve the same variable from their launch environment.

The original DQ can resume after the host loads the plugin. Installation approval, and credential entry or environment setup when required by the host, remain host-owned security steps.

Host configuration

• Codex embeds its native bearer_token_env_var MCP configuration and changes marketplace authentication from ON_USE to ON_INSTALL.
• Claude Code loads the plugin-level .mcp.json and resolves DOABLE_API_KEY from its launch environment.
• Cursor loads the same .mcp.json and collects DOABLE_API_KEY through its required installation variable.

Privacy and compatibility

The package contains only credential-variable references; it does not contain, read, or persist any credential value. Every MCP declaration points only to https://mcp.getdoable.ai/mcp. Version is bumped to 0.2.5 across host manifests.

Verification

• npm test — release verification and 2 helper tests passed
• Cursor plugin and marketplace manifests validated against pinned official Cursor schemas
• plugin-creator validate_plugin.py passed
• Isolated Codex install with a temporary CODEX_HOME loaded v0.2.5 and reported doable with bearer_token_env_var: DOABLE_API_KEY and auth_status: bearer_token
• git diff --check
• No credentials, customer data, private URLs, local paths, or .doable/ state included
• Documentation and manifests updated for the public authentication contract

A true clean install from the public GitHub main branch and a live DQ requires this package version to be merged. Claude Code is not installed on this test machine, so its live host reload remains an explicit post-merge test gap.