feat(claude-in-office): accept mcp_servers key in build-manifest (#55)

Adds mcp_servers to the recognized KEYS table so admins can bake an
org-wide MCP server list into the manifest URL. Documents the key in
commands/manifest.md alongside the other cross-cutting keys, with a
shell-quoted example and a pointer to bootstrap.md for the full schema
and per-user delivery.

claude-in-office/commands/manifest.md

@@ -45,6 +45,21 @@ before the fetch, so one endpoint can branch on a query param.
 See [bootstrap](bootstrap.md) for the request/response contract, JWT
 validation, and handler scaffolding.
 
+## MCP servers
+
+`mcp_servers` is a JSON array of customer-hosted MCP servers the add-in
+connects to directly. Each entry is `{url, label, headers?, discover?}` —
+`headers` present means static auth; absent triggers OAuth discovery. Values
+interpolate other config keys via `{{gateway_url}}`-style templates.
+
+Setting it here applies one list org-wide; per-user lists belong in
+[bootstrap](bootstrap.md#mcp_servers), which also has the full schema. The
+value is JSON inside a shell arg — single-quote it:
+
+```bash
+mcp_servers='[{"url":"{{gateway_url}}/deepwiki/mcp","label":"DeepWiki","headers":{"Authorization":"Bearer {{gateway_token}}"}}]'
+```
+
 ## Auto-connect
 
 Default: when all fields for a provider are set, users skip the connection form

claude-in-office/scripts/build-manifest.mjs

@@ -29,6 +29,7 @@ const KEYS = {
   gateway_url: { pattern: /^https:\/\//, hint: "HTTPS base URL" },
   gateway_token: { pattern: /./, hint: "gateway API key", secret: true },
   gateway_auth_header: { pattern: /^(x-api-key|authorization)$/, hint: "auth header scheme (default: x-api-key)" },
+  mcp_servers: { pattern: /^\[.*\]$/, hint: "JSON array of {url, label, headers?, discover?}" },
   bootstrap_url: { pattern: /^https:\/\//, hint: "HTTPS endpoint returning per-user config" },
   auto_connect: { pattern: /^[01]$/, hint: "0 shows form, 1 (or omit) auto-connects" },
   entra_sso: { pattern: /^[01]$/, hint: "1 enables Entra SSO (required for aws_role_arn)" },