Cited ask API + MCP tools so NestBot can ground security answers in OpenCRE

Parent: https://github.com/OWASP/OpenCRE/issues/1072
Related: #1003 (MCP v1 is public GET only; chat/completion still deferred)

cc @arkid15r

What

Give NestBot (and later Nest MCP clients) a service-to-service way to ask a security question and get an answer with citations (CRE id + standard section URL).

Today:

• POST /rest/v1/completion is session login_required (human chat).
• OpenCRE MCP v1 (application/mcp/catalog.py) has lookup/search GETs only — no ask, no completion.

NestBot cannot spawn our stdio MCP from Slack. They need HTTP.

Expected behaviour

1. Cited ask (REST): e.g. POST /rest/v1/agent/ask (name bikeshed OK)
   • Input: question, optional project_key / standard hint
   • Output: answer, citations[] ({cre_id, standard, section, url}), confidence
   • If below threshold: insufficient_context + search hits, no unsourced essay
2. Auth: machine credential that is not an MCP bypass of MyOpenCRE/admin. Rate-limited. Same spend controls as chat. Not a static secret that dumps the graph.
3. MCP: add tools that wrap the same allowlist — at least text_search, get_cre_by_id, and ask once REST exists. HTTP MCP is Phase 2 if Nest wants protocol not REST.
4. Optional: GET /rest/v1/owasp/project/{nest_key} → CREs/standards for Nest project pages (ASVS, WSTG, Cheat Sheets, Top 10, AI Exchange).

Success criteria

• NestBot (or a curl fixture) can ask “how should I store passwords?” and receive CRE + ASVS (or equivalent) citations.
• Uncited answers are rejected by tests / contract.
• Spend/rate limits documented; no anonymous OpenAI bill repeat of early chat.
• Docs: tool ↔ REST table update in docs/api/mcp.md.
• make lint / make mypy / tests green.

Constraints

• Must not weaken REST auth for convenience (#1003 rule still applies).
• Prefer OpenAPI as schema source of truth.
• Multi-chunk / NotebookLM-style citations are in scope for the answer payload (this is the November Agent demo piece).

Out of scope

• Nest calling us for “next chapter meeting”.
• Hosting Nest’s pgvector corpus.

Start by reading the existing POST /rest/v1/completion flow and application/mcp/catalog.py, then review docs/api/mcp.md and the OpenAPI schema. Define the shared allowlist, machine authentication, rate and spend limits, and cited response contract before implementing the REST and MCP changes. Done means the curl fixture returns cited answers, uncited answers are rejected, documentation is updated, and make lint, make mypy, and tests pass.