fix: merge global MCP config with workspace config with deduplication

[AdJIa]

Problem

Fixes #451

listMcp() was only reading workspace-level opencode.jsonc, completely ignoring global MCP servers configured in ~/.config/opencode/opencode.json. This meant users had to duplicate their global MCP configurations in every workspace.

Solution

Modified packages/server/src/mcp.ts to:

1. Merge configurations: Read both global (~/.config/opencode/opencode.json) and workspace (opencode.jsonc) MCP configs
2. Priority: Workspace config takes precedence over global for same-name MCPs
3. Deduplication: Handle two types of duplicates:
   • Same name: Workspace config wins (already handled by merge order)
   • Different name, same config: Based on URL for remote MCPs or command for local MCPs
4. Source tracking: Each MCP item is tagged with source: "config.global" or source: "config.project"
5. Disable check: Check disabled status against the appropriate config source

Changes

• Added getGlobalOpencodeConfigPath() helper
• Added getMcpConfigId() to generate unique identifiers for deduplication
• Added isSameMcpConfig() for deep comparison fallback
• Refactored listMcp() to merge and deduplicate configs

Testing

To test this fix:

1. Configure MCP servers in ~/.config/opencode/opencode.json
2. Open a workspace with different MCPs in its opencode.jsonc
3. Verify both global and workspace MCPs are available in openwork
4. Verify no duplicates appear when same MCP is defined in both places

Closes #451

Co-authored-by: opencode 令狐冲 opencode@different.ai

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

[benjaminshafii]

Bot disclosure: I'm an automated reviewer (OpenWork bot).

Thanks for the fix — the merge + source tagging is useful. Security-focused review:

1. Dedup for local MCPs in getMcpConfigId strips all --* flags. This can collapse commands that differ in security-relevant flags (sandboxing, allowlists, auth), which could allow a more permissive project config to shadow a safer global config. Suggestion: only ignore a small allowlist like -y/--yes, or keep the full command/args in the ID.
2. isSameMcpConfig ignores environment. If two configs differ only by env vars (tokens/endpoints), one will be dropped and the remaining one may be used with the wrong credentials. Suggestion: include environment in equality (or at least compare env keys/values).
3. listMcp now returns global configs too; if environment contains secrets, those will be surfaced to any consumer of McpItem. Please confirm UI/API redaction or consider redacting secrets here.
4. Workspace config can shadow global entries by name. Please ensure the UI surfaces source prominently and requires explicit user approval before running workspace-sourced remote MCPs.

Non-security:

• Please translate the new Chinese comments in packages/server/src/mcp.ts to English so CJK text doesn't bleed into the codebase.

No tests run.