chore(swiss-ai-hub): Add test coverage and useful resource descriptions to /mcp

[joelbarmettlerUZH]

/mcp (packages/api/swiss_ai_hub/api/runners/api_runner.py) wraps the REST API with FastMCP.from_fastapi(), exposing GET routes as MCP resources. It has no test coverage, and its resource descriptions are only as good as the underlying routes' OpenAPI metadata, which is sparse: only 8 of 25 controller files set an explicit route summary=, and most GET endpoints have no description= on their path or query parameters. An MCP client sees auto-derived, often unhelpful resource names with no guidance on what they return or what their parameters mean.

#668 will eventually replace this wrapper with a purpose-built server exposing tools, sampling, and elicitation, but that effort hasn't started. Until it lands, /mcp is what real MCP clients see.

In scope

• A test suite exercising /mcp end-to-end: the mount serves, resources are listed, and a representative resource and resource template can be read and return the same data as their underlying REST route.
• Explicit summary=/description= on the routes most likely used as MCP resources today: the highest-traffic GET endpoints for knowledge, agent, and thread listing/detail, plus description= on their path/query parameters, so FastMCP.from_fastapi() derives useful resource metadata instead of auto-generated names.
• A short documented convention (e.g. in the API scope's README) for what a new route needs so it reads well as an MCP resource, preventing regression as endpoints are added.

Out of scope

• Replacing the wrapper with a purpose-built server exposing tools, sampling, elicitation, and mutating actions (see Replace the FastMCP REST wrapper with a purpose-built MCP server (tools, resources, sampling, elicitation) #668, separate effort).
• The hub-assistant blueprint that consumes MCP tools with per-user auth (see Personal hub assistant acting with the inviting user's own access to aihub's MCP server #1784, sibling); that work needs Replace the FastMCP REST wrapper with a purpose-built MCP server (tools, resources, sampling, elicitation) #668's action-capable tools, not this issue's read-only resource hardening.
• Documenting every route in the API: this covers the highest-traffic surfaces most likely to be read via MCP today.

Accepted when

• /mcp has test coverage confirming it serves and that reading a resource returns correct data.
• The highest-traffic knowledge/agent/thread resources have clear, accurate names and descriptions when browsed via MCP, not auto-generated ones.
• make test passes in the affected scopes.