Add compact/ARIA render modes, fix framework transitions

- Add compact render mode (now default): LLM-optimized ~75% smaller output
  - Shows forms with fields, grids with sample rows, actions with services
  - Truncates dropdown options with fetch hints

- Add ARIA render mode: W3C accessibility tree format
  - Maps Moqui fields to ARIA roles (textbox, combobox, checkbox, etc.)

- Fix action execution to use framework transitions
  - Actions now append to screen path for proper transition handling
  - Framework handles inheritance, pre/post actions, response handling

- Fix CSRF bypass for MCP requests
  - Set moqui.request.authenticated=true in MockHttpServletRequest attributes

@@ -324,6 +324,7 @@ class WebFacadeStub implements WebFacade {
         private String screenPath
         private String screenPath
         private String remoteUser = null
         private String remoteUser = null
         private java.security.Principal userPrincipal = null
         private java.security.Principal userPrincipal = null
+        private Map<String, Object> attributes = [:]
         
         
         MockHttpServletRequest(Map<String, Object> parameters, String method, HttpSession session = null, String screenPath = null) {
         MockHttpServletRequest(Map<String, Object> parameters, String method, HttpSession session = null, String screenPath = null) {
             this.parameters = parameters ?: [:]
             this.parameters = parameters ?: [:]
@@ -331,6 +332,10 @@ class WebFacadeStub implements WebFacade {
             this.session = session
             this.session = session
             this.screenPath = screenPath
             this.screenPath = screenPath
             
             
+            // Mark request as authenticated for MCP - bypasses CSRF token check for transitions
+            // This is safe because MCP requests are already authenticated via the MCP session
+            this.attributes["moqui.request.authenticated"] = "true"
+            
             // Extract user information from session attributes for authentication
             // Extract user information from session attributes for authentication
             if (session) {
             if (session) {
                 def username = session.getAttribute("username")
                 def username = session.getAttribute("username")
@@ -385,9 +390,9 @@ class WebFacadeStub implements WebFacade {
         @Override String getProtocol() { return "HTTP/1.1" }
         @Override String getProtocol() { return "HTTP/1.1" }
         
         
         // Other required methods with minimal implementations
         // Other required methods with minimal implementations
-        @Override Object getAttribute(String name) { return null }
-        @Override void setAttribute(String name, Object value) {}
-        @Override void removeAttribute(String name) {}
+        @Override Object getAttribute(String name) { return attributes.get(name) }
+        @Override void setAttribute(String name, Object value) { attributes[name] = value }
+        @Override void removeAttribute(String name) { attributes.remove(name) }
         @Override java.util.Enumeration<String> getAttributeNames() { return Collections.enumeration([]) }
         @Override java.util.Enumeration<String> getAttributeNames() { return Collections.enumeration([]) }
         @Override String getAuthType() { return null }
         @Override String getAuthType() { return null }
         @Override String getRemoteUser() { return remoteUser }
         @Override String getRemoteUser() { return remoteUser }