Operator view: structured, queryable runtime state for MCPServer

## Problem

Right now there is no single place to ask "what is this MCP server actually doing?" The operator has to piece together answers from kubectl logs, config files, and process state. Nothing is structured or queryable at runtime.

This makes it hard to answer basic operational questions:
- Is this server healthy, and if not, what was the last error?
- What tools are actually registered (vs what the config says)?
- What transport is active and what is the connection state?
- What auth source is it using, and is it currently valid?
- Which agent or session last used this server?

## Proposed: MCPServer runtime status fields

Extend the `MCPServer` status subresource (`api/v1alpha1/`) with a `RuntimeStatus` section the operator populates from live probing:

```go
type MCPServerRuntimeStatus struct {
// Tools registered at last probe
ToolInventory []ToolEntry `json:"toolInventory,omitempty"`
// Transport type (stdio, sse, http) and connection state
Transport TransportStatus `json:"transport,omitempty"`
// Auth source and whether it resolved successfully at last check
AuthSource AuthSourceStatus `json:"authSource,omitempty"`
// Last observed error surface
LastError *MCPErrorEvent `json:"lastError,omitempty"`
// Agent/session that last used this server
LastSession *SessionRef `json:"lastSession,omitempty"`
// Probe timestamp
LastProbeTime metav1.Time `json:"lastProbeTime,omitempty"`
}
```

## Implementation sketch

1. **CRD** (`api/v1alpha1/`, `config/crd/bases/`) — add `RuntimeStatus` to `MCPServerStatus`; update deepcopy and generated code
2. **Operator** (`internal/operator/`) — add a probe reconciler that calls `tools/list` (and optionally `health` if the server exposes it) on a configurable interval; writes result to `.status.runtimeStatus`
3. **Sentinel API** (`services/api`) — expose `GET /api/runtime/servers/{name}/status` returning the runtime status
4. **CLI** (`internal/cli/`) — surface in `mcp-runtime server status ` or extend existing `status` command
5. **UI** (`services/ui`) — optional: panel on the MCPServer detail page showing live tool inventory and last session

## Transport coverage

| Transport | Probe mechanism |
|-----------|----------------|
| stdio | operator has the process; can send `tools/list` over the existing pipe |
| SSE / HTTP | operator sends `tools/list` request to the in-cluster endpoint |

## Open questions

- Probe interval: configurable on MCPServer spec, or global operator flag?
- Tool schema diff: should we surface when tool signatures change between probes?
- Auth validity check: passive (did the last call succeed?) vs active (re-resolve the source on each probe)?
- `LastSession` sourcing: read from Sentinel events or from the gateway access log?