fix(cc-config): MCP scope was inverted — expose user/local, not user/project

readMcpServers only ever parses ~/.claude.json (top-level = user scope,
projects[<root>] = the panel's "projectScoped" bucket, which the CLI itself
calls `local`). The previous user/project scope choice was the exact
inverse: `--scope project` writes .mcp.json, which readMcpServers never
reads (a successful add would vanish), and every "projectScoped" row was
actually `local`, so Remove sent a scope the CLI could never match.

- cc-mcp-cli.js: MCP_SCOPES -> ["user", "local"]; drop the local
  mutationQueue/serialize in favor of cc-plugin-cli.js's exported one, so a
  plugin install and an MCP add can't spawn `claude` concurrently; drop the
  String(v) coercion in env/header flags (a wrong-typed value is now a 400,
  not a written "[object Object]"); assertEmbeddedValue allows empty strings
  (a legitimate empty stdio arg was previously a 400).
- cc-plugin-cli.js: export `serialize` for reuse.
- CcConfig.tsx: CcMcpScope narrowed to user/local; the projectScoped bucket's
  McpCard now sends scope="local"; rows sourced from
  ~/.claude/settings.json (no CLI scope addresses them) no longer render a
  Remove button. Cleaned up i18n keys my own earlier change made dead
  (explain.mcp.addCmd/remove/removeButton) and gave the scope <select> its
  own short option labels instead of reusing full-sentence section headings.

server/__tests__/cc-config.test.js

@@ -1192,7 +1192,7 @@ describe("/api/cc-config", () => {
     try {
       const { status, body } = await fetchJson("/api/cc-config/mcp/remove", {
         method: "POST",
-        body: { name: "docs", scope: "project" },
+        body: { name: "docs", scope: "local" },
       });
       assert.equal(status, 200);
       assert.deepEqual(body.stdout.trim().split("\n"), [
@@ -1200,10 +1200,19 @@ describe("/api/cc-config", () => {
         "remove",
         "docs",
         "--scope",
-        "project",
+        "local",
       ]);
     } finally {
       restore();
     }
   });
+
+  it("POST /mcp/remove rejects the CLI's project scope with 400 — .mcp.json isn't addressable here", async () => {
+    const { status, body } = await fetchJson("/api/cc-config/mcp/remove", {
+      method: "POST",
+      body: { name: "docs", scope: "project" },
+    });
+    assert.equal(status, 400);
+    assert.equal(body.error.code, "EBADARG");
+  });
 });