feat: add signed MCP audit receipts

[gyx09212214-prog]

Summary

Adds optional signed JSONL audit receipts for OpenBB MCP server tool calls, addressing #7455 with a narrowly scoped MVP.

The feature is disabled by default. When enabled, each MCP tool call emits a tamper-evident receipt containing the tool name, canonical argument hash, timestamp, status, duration, principal, public key, and Ed25519 signature.

What changed

• Added an AuditReceipt model and AuditReceiptMiddleware for FastMCP on_call_tool events.
• Added MCP settings/env vars for enabling receipts, choosing the JSONL output path, supplying the Ed25519 signing key, setting a principal, and optionally including raw arguments.
• Default behavior records only arguments_sha256, not raw tool arguments, to reduce the chance of persisting sensitive query details.
• Added README documentation with key generation and configuration examples.
• Added tests for successful calls, failed calls, signature verification, argument hashing, settings defaults, and server middleware registration.

Validation

• python -m pytest tests -q
  • 181 passed, 2 skipped
• python -m ruff check openbb_mcp_server\models\audit.py openbb_mcp_server\utils\audit.py openbb_mcp_server\models\settings.py openbb_mcp_server\app\app.py tests\utils\test_audit.py tests\models\test_mcp_settings.py tests\app\test_app.py
  • All checks passed!

Notes

This intentionally does not add a policy engine in the first PR. policy_decision is recorded as allow so the receipt schema has a stable place for future authorization decisions without expanding the initial review scope.