feat(mcp): add MCP settings fields to Settings (T10.4)

Adds mcp_enabled/mcp_transport/mcp_port/mcp_expose/mcp_expose_recordings
to Settings, all defaulting to off/none so an upgrading settings.json
gets a fully-local default (FR-MCP-1). The auth token itself never lives
here -- OS credential store only (see mcp::token, next commit).

src-tauri/src/models.rs

@@ -226,6 +226,33 @@ pub struct Settings {
     // default capture device.
     #[serde(default)]
     pub audio_input_device: Option<String>,
+    // Local MCP server (Phase 10b, ADR-0011, FR-MCP-1). OFF by default; the
+    // auth token itself is NEVER stored here — only in the OS credential
+    // store (see `mcp::token`). `mcp_expose` is one of none|selected|all;
+    // `mcp_expose_recordings` gates access to meetings with retained audio
+    // (ADR-0009) regardless of `mcp_expose` (FR-MCP-3).
+    #[serde(default)]
+    pub mcp_enabled: bool,
+    #[serde(default = "default_mcp_transport")]
+    pub mcp_transport: String, // http|stdio
+    #[serde(default = "default_mcp_port")]
+    pub mcp_port: u16,
+    #[serde(default = "default_mcp_expose")]
+    pub mcp_expose: String, // none|selected|all
+    #[serde(default)]
+    pub mcp_expose_recordings: bool,
+}
+
+fn default_mcp_transport() -> String {
+    "http".into()
+}
+
+fn default_mcp_port() -> u16 {
+    4849
+}
+
+fn default_mcp_expose() -> String {
+    "none".into()
 }
 
 /// serde default for a `bool` field that should be `true` when absent from an