fix(cc-config): read .claude.json from the same root the CLI writes it to

getClaudeJsonPath() was the only one of cc-discovery's 20 read paths not
derived from getClaudeHome(), so a CLAUDE_HOME install read one file while
the CLI wrote another. The default case was fixed by dropping the
CLAUDE_CONFIG_DIR pin; this closes the mirrored half.

Also replaces the Remove button's display-string comparison with a
removable flag from the reader: rewording the source label silently
resurrected a button that always fails.

server/lib/cc-discovery.js

@@ -29,16 +29,13 @@ function getProjectClaudeDir(cwd) {
 }
 
 function getClaudeJsonPath() {
-  // ~/.claude.json sits beside ~/.claude/, NOT inside it. Resolve from $HOME
-  // so a CLAUDE_HOME override doesn't accidentally relocate it.
-  //
-  // Paired with cc-plugin-cli.js's runClaude(): with CLAUDE_HOME unset (the
-  // default), it deliberately leaves CLAUDE_CONFIG_DIR unset too, so the CLI
-  // writes here (its own default). With CLAUDE_HOME set, this read stays
-  // pinned to $HOME/.claude.json while the CLI writes
-  // <CLAUDE_HOME>/.claude.json — a known, unfixed split for that case; see
-  // runClaude's comment.
-  return path.join(os.homedir(), ".claude.json");
+  // One root for everything: this file used to resolve from $HOME while the
+  // other 19 read paths derived from getClaudeHome(), and cc-plugin-cli.js's
+  // runClaude() pinned CLAUDE_CONFIG_DIR to getClaudeHome() — which is where
+  // the CLI puts .claude.json. The dashboard read one file and made the CLI
+  // write another, so MCP add/remove was inert. Keep this and runClaude's
+  // env in step; they are the same decision seen from two sides.
+  return path.join(getClaudeHome(), ".claude.json");
 }
 
 /**
@@ -516,6 +513,11 @@ function readMcpServers(opts = {}) {
       out.user.push({
         name,
         source: "~/.claude/settings.json",
+        // No `claude mcp` scope addresses settings.json, so the dashboard
+        // cannot remove these. A flag, not a string comparison on `source`:
+        // the UI used to match that display text, so rewording it silently
+        // brought back a Remove button that always fails.
+        removable: false,
         ...summarizeMcpDef(def),
       });
     }
@@ -911,6 +913,9 @@ function readOverview(opts = {}) {
 }
 
 module.exports = {
+  // Exported so a test can pin it against the file the CLI writes — the two
+  // drifted apart once and the mismatch was invisible from either side alone.
+  getClaudeJsonPath,
   // surface readers
   readSkills,
   readAgents,