feat: enable catalog writes, with the conversation history they require

The gateway already authorised writes for a product_manager — ai-mcp-proxy
filters tool discovery by consumer group, so create-product is simply absent
from a read-only user's turn. Only the system prompt was holding the agent
back, and it now describes how to write instead: restate the record, ask for
confirmation, never invent a missing field, report the identifier, and stop on
a refusal rather than working around it.

That flow cannot terminate without history. Each turn built a fresh Agent with
no message_history, so the user's "yes" arrived at an agent that had no idea
what it was agreeing to. History is now kept per A2A contextId in a bounded
in-memory map — enough for confirm-then-act, deliberately not durable, and
documented as needing sticky routing beyond one replica.

Verified end to end: pm-user creates S99_TEST1 across two turns and the row
appears in MySQL; ro-user asking for the same thing is told no write tool
exists, because for that token none does. Both test rows removed afterwards.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/catalogue_agent/mcp_clients.py

@@ -74,7 +74,8 @@ async def build_toolsets(
                 StreamableHttpTransport(
                     url=target.url,
                     headers={"Authorization": f"Bearer {token}"},
-                    verify=settings.verify,
+                    # No `verify=` here: the factory below sets it, and passing
+                    # both makes fastmcp ignore this one with a warning.
                     httpx_client_factory=client_factory,
                 ),
                 id=target.name,