feat: give every MCP client its own token, rate limit and log name

config/packages/security.yaml

@@ -15,11 +15,11 @@ security:
                     mailjet:
                         password: '%env(MAILJET_WEBHOOK_BASIC_PASSWORD)%'
                         roles: [ ROLE_MAILJET_WEBHOOK ]
+        # Never consulted: McpAccessTokenHandler builds the user from the client name its
+        # token belongs to. Named only because a firewall must have a provider.
         mcp_provider:
             memory:
-                users:
-                    n8n:
-                        roles: [ ROLE_CHATBOT_MCP ]
+                users: []
 
     role_hierarchy:
         # ROLE_CUSTOMER_EXPERT gates the booking-draft and log surfaces, which used to be