refactor(agents): evict mac-only tools/middleware from shared kernel

These were never shared with anonymous_chat (nor podcaster/video_presentation)
-- only multi_agent_chat (subagents/main agent) and the boundary use them:

  shared/tools/mcp/             -> multi_agent_chat/shared/tools/mcp/
  shared/tools/hitl.py          -> multi_agent_chat/shared/tools/hitl.py
  shared/tools/catalog.py       -> multi_agent_chat/shared/tools/catalog.py
  shared/middleware/dedup_tool_calls.py
                                -> multi_agent_chat/shared/middleware/dedup_tool_calls.py

app/agents/shared/ now holds only the genuine anon<->mac kernel:
context, middleware/{compaction,retry_after}, tools/web_search.

surfsense_backend/tests/e2e/fakes/mcp_runtime.py

@@ -137,10 +137,10 @@ def install(active_patches: list[Any]) -> None:
     """Patch production MCP streamable-HTTP boundaries exactly once."""
     targets = [
         (
-            "app.agents.shared.tools.mcp.tool.streamablehttp_client",
+            "app.agents.multi_agent_chat.shared.tools.mcp.tool.streamablehttp_client",
             _fake_streamablehttp_client,
         ),
-        ("app.agents.shared.tools.mcp.tool.ClientSession", _FakeClientSession),
+        ("app.agents.multi_agent_chat.shared.tools.mcp.tool.ClientSession", _FakeClientSession),
     ]
     for target, replacement in targets:
         p = patch(target, replacement)

surfsense_backend/tests/unit/agents/new_chat/test_dedup_tool_calls.py

@@ -115,7 +115,9 @@ def test_full_args_dedup_keeps_distinct_calls_sharing_a_field() -> None:
 
     With :func:`dedup_key_full_args` only fully identical arg dicts dedup.
     """
-    from app.agents.shared.middleware.dedup_tool_calls import dedup_key_full_args
+    from app.agents.multi_agent_chat.shared.middleware.dedup_tool_calls import (
+        dedup_key_full_args,
+    )
 
     tool = _make_tool("createJiraIssue", dedup_key=dedup_key_full_args)
     mw = DedupHITLToolCallsMiddleware(agent_tools=[tool])
@@ -157,7 +159,9 @@ def test_full_args_dedup_keeps_distinct_calls_sharing_a_field() -> None:
 
 
 def test_full_args_dedup_drops_only_exact_duplicates() -> None:
-    from app.agents.shared.middleware.dedup_tool_calls import dedup_key_full_args
+    from app.agents.multi_agent_chat.shared.middleware.dedup_tool_calls import (
+        dedup_key_full_args,
+    )
 
     tool = _make_tool("createJiraIssue", dedup_key=dedup_key_full_args)
     mw = DedupHITLToolCallsMiddleware(agent_tools=[tool])

surfsense_backend/tests/unit/agents/new_chat/test_default_permissions_layering.py

@@ -17,7 +17,7 @@ caused two production-painful behaviors:
   read-only tool calls, raising ``RejectedError("ls")``.
 * Mutating connector tools got *double* prompted — once via the
   middleware ``ask`` and again via the per-tool ``interrupt()`` in
-  ``app.agents.shared.tools.hitl``.
+  ``app.agents.multi_agent_chat.shared.tools.hitl``.
 
 These tests pin the layering so a refactor that drops the default
 ruleset fails loud.

surfsense_backend/tests/unit/agents/new_chat/test_hitl_auto_approve.py

@@ -10,7 +10,7 @@ from __future__ import annotations
 
 import pytest
 
-from app.agents.shared.tools.hitl import (
+from app.agents.multi_agent_chat.shared.tools.hitl import (
     DEFAULT_AUTO_APPROVED_TOOLS,
     HITLResult,
     request_approval,

surfsense_backend/tests/unit/agents/new_chat/tools/test_mcp_tools_cache.py

@@ -7,7 +7,7 @@ from types import SimpleNamespace
 
 import pytest
 
-from app.agents.shared.tools.mcp.cache import (
+from app.agents.multi_agent_chat.shared.tools.mcp.cache import (
     CachedMCPToolDef,
     CachedMCPTools,
     read_cached_tools,

surfsense_backend/tests/unit/middleware/test_dedup_hitl_tool_calls.py

@@ -5,7 +5,7 @@ from langchain_core.tools import StructuredTool
 from app.agents.multi_agent_chat.main_agent.middleware.dedup_hitl import (
     DedupHITLToolCallsMiddleware,
 )
-from app.agents.shared.middleware.dedup_tool_calls import (
+from app.agents.multi_agent_chat.shared.middleware.dedup_tool_calls import (
     wrap_dedup_key_by_arg_name,
 )