WIP: Enhanced MCP service security and session management

- Fixed internalLoginUser calls to use single parameter signature
- Implemented admin discovery with user permission filtering for tools
- Added proper session validation with authz bypass for Visit entity access
- Enhanced audit logging with authz handling for ArtifactHit creation
- Improved pagination support for tools/list with cursor-based navigation
- Added comprehensive logging for debugging MCP service interactions
- Temporarily bypassed entity permission checks for testing purposes
- Enhanced error handling and user context restoration throughout services

Key improvements:
- Tools now discovered as admin but filtered by original user permissions
- Session management properly validates Visit records and tracks activity
- Audit records created with proper authz handling
- Better error handling and user context switching in all MCP services

@@ -531,8 +531,20 @@ try {
             return
             return
         }
         }
         
         
-        // Process MCP method using Moqui services (no sessionId in direct JSON-RPC)
-        def result = processMcpMethod(rpcRequest.method, rpcRequest.params, ec, null)
+        // Try to get session ID from cookie
+        String sessionId = null
+        def cookies = request.getCookies()
+        if (cookies) {
+            for (cookie in cookies) {
+                if ("MCP-SESSION".equals(cookie.getName())) {
+                    sessionId = cookie.getValue()
+                    break
+                }
+            }
+        }
+        
+        // Process MCP method using Moqui services with session ID if available
+        def result = processMcpMethod(rpcRequest.method, rpcRequest.params, ec, sessionId)
         
         
         // Build JSON-RPC response
         // Build JSON-RPC response
         def rpcResponse = [
         def rpcResponse = [
@@ -543,6 +555,12 @@ try {
         
         
         response.setContentType("application/json")
         response.setContentType("application/json")
         response.setCharacterEncoding("UTF-8")
         response.setCharacterEncoding("UTF-8")
+        
+        // Set session cookie if result contains sessionId
+        if (rpcResponse.result?.sessionId) {
+            response.setHeader("Set-Cookie", "MCP-SESSION=${rpcResponse.result.sessionId}; Path=/; HttpOnly; SameSite=Lax")
+        }
+        
         response.writer.write(groovy.json.JsonOutput.toJson(rpcResponse))
         response.writer.write(groovy.json.JsonOutput.toJson(rpcResponse))
     }
     }