feat: give every MCP client its own token, rate limit and log name

config/packages/framework.yaml

@@ -17,7 +17,7 @@ framework:
         log: true
 
     rate_limiter:
-      # Per MCP token. A chatbot turn makes a few tool calls; this catches runaway loops.
+      # Per MCP client. A chatbot turn makes a few tool calls; this catches runaway loops.
       chatbot_mcp:
         policy: sliding_window
         limit: 60

config/packages/security.yaml

@@ -15,11 +15,11 @@ security:
                     mailjet:
                         password: '%env(MAILJET_WEBHOOK_BASIC_PASSWORD)%'
                         roles: [ ROLE_MAILJET_WEBHOOK ]
+        # Never consulted: McpAccessTokenHandler builds the user from the client name its
+        # token belongs to. Named only because a firewall must have a provider.
         mcp_provider:
             memory:
-                users:
-                    n8n:
-                        roles: [ ROLE_CHATBOT_MCP ]
+                users: []
 
     role_hierarchy:
         # ROLE_CUSTOMER_EXPERT gates the booking-draft and log surfaces, which used to be

config/services.yaml

@@ -340,7 +340,7 @@ services:
 
     App\Security\McpAccessTokenHandler:
       arguments:
-        $token: '%env(APP_MCP_TOKEN)%'
+        $tokens: '%env(APP_MCP_TOKENS)%'
 
     App\Service\CmsDataProvider:
       arguments: