feat(registry): serve the MCP store from a static JSON catalog over REST

[viktormarinho]

What is this contribution about?

Moves the MCP store/registry off per-org Postgres rows + the MCP-binding fan-out and onto a single static JSON catalog (decocms/mcps registry.json), fetched and cached server-side and served via a plain REST route. Adds a new apps/mesh/src/registry-catalog/ module (single-flight + stale-while-revalidate + fail-soft caching, normalize → CatalogItem, in-memory merge/filter/paginate, 33 unit tests), a GET /api/registry/items[/:id] route, and a REGISTRY_CATALOG_URL setting (defaults to the decocms catalog). The frontend store hooks (use-merged-store-discovery, use-install-from-registry) are rewired to the REST catalog with their signatures unchanged, so call sites are untouched. This is additive and merge-dark: the legacy Postgres registry, its tools, the public MCP shim, and the seeded registry connections remain in place (just unused by the store), with their removal to follow in a separate PR. Cross-repo: the catalog lives in decocms/mcps (PR #476 merged, #477 adds GitHub's official MCP, issue #478 tracks retiring the old Supabase server).

Screenshots/Demonstration

No visual change — the store renders the same items, now sourced from the catalog instead of the per-registry MCP fan-out.

How to Test

1. With REGISTRY_CATALOG_URL unset (uses the default decocms raw catalog) or set to a registry.json URL, run the app.
2. curl 'localhost:3000/api/registry/items?search=stripe' → returns catalog items; open the "Add connection"/store dialog → items load + search works.
3. Install an MCP (e.g. Stripe/Notion) → a connection is created with the correct server.remotes[].url.

Migration Notes

Config only: REGISTRY_CATALOG_URL (HTTPS, optional — defaults to https://raw.githubusercontent.com/decocms/mcps/main/registry.json). No database migration in this PR; the table/connection drops come in the follow-up deletion PR.

Review Checklist

• PR title is clear and descriptive
• Changes are tested and working (33 unit tests + a live-catalog smoke test; full app-run verification pending)
• Documentation is updated (if needed)
• No breaking changes (additive; legacy registry untouched)

---

Summary by cubic

Serve the MCP store from a static JSON catalog over REST to simplify and speed up discovery and installs. The frontend now reads the catalog via REST (no hook API changes) and stamps items with the Deco Store source id to keep existing filters/badges working.

• New Features

  • Added a server-side catalog that fetches REGISTRY_CATALOG_URL (defaults to https://raw.githubusercontent.com/decocms/mcps/main/registry.json), with single-flight + stale-while-revalidate caching (1h TTL), normalization, merge/dedupe, and 33 tests.
  • Exposed GET /api/registry/items and GET /api/registry/items/:id (global, read-only) and warm the cache on boot.
  • Rewired use-merged-store-discovery and use-install-from-registry to call the REST catalog and stamp items with the Deco Store _registryId; signatures unchanged and no UI changes.
  • Cleanups: removed unused registry-utils (fan-out helpers) and dropped unused barrel re-exports flagged by knip.

• Migration

  • Optional config: set REGISTRY_CATALOG_URL (HTTPS; localhost may use http). Defaults to the first-party decocms catalog. No database changes or call-site updates required.

^{Written for commit 8550a8d. Summary will update on new commits.}