feat: MCP admin-level tools — Claude Code can manage the full agency

7 new WRITE MCP tools (15 total):
- create_deal: create deals with value, stage, probability
- update_deal_stage: move deals through the pipeline
- create_task: create tasks with priority, assignee, estimate
- log_time: log billable time entries with rate
- create_invoice: create draft invoices with line items
- finalize_invoice: lock + set to sent (GoBD Festschreibung)
- run_recurring: trigger recurring invoice scheduler + license suspend

Added scopes: crm.deal:write, finance.invoice:write, finance:write, projects:write
Claude Code with an admin token can now:
- Search companies, view pipeline, check invoices (read)
- Create deals, tasks, log time, create+finalize invoices (write)
- Run the recurring scheduler (admin)
- Approve leads, create tickets (existing write tools)

All actions audit-logged with actor 'mcp-agent'

src/app/api/aos/api-tokens/route.ts

@@ -7,12 +7,16 @@ export const dynamic = 'force-dynamic'
 const ALL_SCOPES = [
   'crm.company:read',
   'crm.deal:read',
+  'crm.deal:write',
   'finance.invoice:read',
+  'finance.invoice:write',
+  'finance:write',
   'licenses.license:read',
   'leads:read',
   'leads:write',
   'support:read',
   'support:write',
+  'projects:write',
   'webhooks.test',
   'mcp:read',
   'mcp:write',