[Bug] Embedded mode: McpBridge not pushed to Envoy via xDS — file apiserver missing McpBridge CRD registration

## Bug Description

In HiClaw embedded mode (single-host Docker), the Higress AI Gateway cannot route LLM requests. All requests through the gateway (port 8080) return HTTP 503 Service Unavailable.

The root cause: **the file apiserver (port 18443) does not register McpBridge as a watchable resource for the pilot-discovery (Istio xDS server).** Even though McpBridge data is present in `/data/mcpbridges/default.yaml` and is queryable through the file apiserver API, the pilot-discovery never sees it because McpBridge is not in the hardcoded CRD type list of the file apiserver binary.

This is essentially the same issue as **#476** ("AI Gateway Route Configuration Lost After System Restart"), which was closed as stale. We have a complete diagnosis now.

## Affected Components

- HiClaw (AgentTeams) v1.1.2 embedded mode
- Higress file apiserver (port 18443, `--storage file`)
- Istio pilot-discovery (port 15080, `KUBECONFIG=/app/kubeconfig`)
- Envoy (port 15000)

## Root Cause Chain

```
1. McpBridge YAML file: openai-compat.dns → correct upstream ✅
/data/mcpbridges/default.yaml has the registry entry

2. file apiserver: serves McpBridge data ✅
curl -sk https://localhost:18443/apis/networking.higress.io/v1/mcpbridges
→ returns 1 McpBridge with 3 registries

3. pilot-discovery: does NOT see McpBridge ❌
curl http://localhost:15080/debug/configz
→ no McpBridge resource (only EnvoyFilter, Gateway, WasmPlugin, Ingress, etc.)

4. Envoy: missing cluster ❌
curl http://localhost:15000/clusters
→ only higress-console.static and tuwunel.static, no openai-compat.dns
```

## Why pilot-discovery can't see McpBridge

The file apiserver is a simplified Kubernetes-like server (binary `apiserver`, `--storage file --file-root-dir /data`).

Its CRD type list is **hardcoded in the binary**. The running instance only supports:
- GatewayClass, Gateway, HTTPRoute, ReferenceGrant (gateway.networking.k8s.io)
- EnvoyFilter (networking.istio.io)

McpBridge (`networking.higress.io/v1`) is NOT in this list.

pilot-discovery uses `KUBECONFIG=/app/kubeconfig` pointing to `https://localhost:18443` (the file apiserver). It only watches resources that are registered as CRDs. Since McpBridge is not a CRD in the file apiserver, pilot-discovery never creates the Envoy cluster.

## What We Tried

| Attempt | Result |
|---------|--------|
| Edit McpBridge YAML + add labels | ❌ Labels don't affect CRD registration |
| Register McpBridge CRD via kube-apiserver (6443) | ❌ pilot watches file apiserver (18443), not kube-apiserver |
| Create McpBridge in kube-apiserver + CRD | ❌ kube-apiserver has no xDS pipeline to Envoy |
| Higress Console API (service-sources/providers/routes) | ⚠️ Config stored in console but not pushed to Envoy |
| Direct edit of envoy-rev.json | ❌ Regenerated by pilot-agent on restart |
| Restart controller / kill envoy / HUP signals | ❌ Envoy config reloads but cluster never added |

## Workaround

**Bypass the gateway entirely.** Point the Manager's LLM provider directly to the upstream:

```json
// .copaw.secret/providers/custom/hiclaw-gateway.json
{
"base_url": "http://hiclaw-headroom-proxy:8782/v1",
"api_key": ""
}
```

This sacrifices AI Proxy features (token counting, multi-provider routing, rate limiting) but keeps the Manager working.

## Proposed Fix

The file apiserver binary needs to include `McpBridge` in its hardcoded CRD type list, OR the pilot-discovery should use a different kubeconfig that points to the kube-apiserver (6443) which HAS the McpBridge CRD registered.

Alternatively, the embedded controller could bypass the xDS mechanism entirely and directly configure Envoy clusters from the McpBridge YAML files.

## Related

- #476 — Same symptoms, closed without fix
- File apiserver binary: `/usr/local/bin/apiserver` inside `hiclaw-embedded` image
- pilot-discovery: `/usr/local/bin/pilot-discovery` inside same image

## Environment

- OS: Arch Linux, kernel 6.18.9, Docker 29.3.0
- HiClaw v1.1.2, embedded single-host install
- LLM: DeepSeek v4 Flash, custom OpenAI-compatible API