feat: Verify citations

[4ndrelim]

Supports XtraMCP tool on validating citations and references used across an Overleaf project.

Note: This PR also added v2 api integration for xtramcp but it is currently commented and will be propsoed for enabling in the next PR when improving the MCP client workflow. That PR will introduce display and interpret types for XtraMCP tools where the former will skip MCP client response and display results verbatim whereas the latter allows the client to interpret and display.

[Copilot]

Pull request overview

This PR enables the verify_citations tool in the XtraMCP toolkit by implementing a security context injection mechanism that automatically injects user and project credentials for authentication and authorization.

• Enabled the verify_citations tool in the frontend configuration
• Implemented security context injection to automatically provide user_id and project_id parameters
• Added schema filtering to hide security parameters from the LLM

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
webapp/_webapp/src/components/message-entry-container/tools/tools.tsx	Uncommented verify_citations to enable the tool in the frontend
internal/services/toolkit/tools/xtramcp/tool_v2.go	Added security context injection logic with authentication and authorization checks (v2)
internal/services/toolkit/tools/xtramcp/tool.go	Added security context injection logic with authentication and authorization checks (v1)
internal/services/toolkit/tools/xtramcp/schema_filter.go	New file implementing schema filtering to remove security parameters from LLM-visible schemas
internal/services/toolkit/tools/xtramcp/loader_v2.go	Modified to detect tools requiring injection and pass the flag during tool creation (v2)
internal/services/toolkit/tools/xtramcp/loader.go	Modified to detect tools requiring injection and pass the flag during tool creation (v1)
internal/services/toolkit/client/utils_v2.go	Updated logging prefixes for consistency
internal/services/toolkit/client/utils.go	Updated logging prefixes for consistency

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Junyi-99]

To avoid duplicated logic, please remove the corresponding implementation from the v1 APIs and implement the new feature only in the v2 APIs.

(Since xtramcp was not enabled in previous versions, we can simply throw an exception in the v1 APIs without implementing it.)