feat: web access via MCP (Firecrawl search/scrape) + mcp server attach support

- agent/web_mcp.py: stdio MCP server exposing web_search and web_scrape,
  backed by the self-hosted Firecrawl stack on xNAS (no API key needed)
- agent.py: Agent now attaches mcp_servers built from config; EXTRA_MCP_SERVERS
  env var allows adding arbitrary HTTP/SSE MCP servers as JSON
- Dockerfile: installs livekit-agents[mcp], copies web_mcp.py
- .env.example: WEB_MCP_ENABLED, FIRECRAWL_BASE, EXTRA_MCP_SERVERS documented

web/token_server.py

@@ -3,6 +3,11 @@
 
 Serves POST /token -> { "token": "<signed JWT>" }
 Signs a LiveKit access token with HS256 using the API key/secret from env.
+
+The token carries a roomConfig claim requesting the voice-assistant agent, so
+LiveKit dispatches the agent when the participant joins. Without this, the
+auto-created room would get no agent at all.
+
 Runs as a separate supervisord process; nginx proxies /token to it.
 """
 import base64
@@ -17,24 +22,32 @@ from http.server import BaseHTTPRequestHandler, HTTPServer
 
 API_KEY = os.environ.get("LIVEKIT_API_KEY", "devkey")
 API_SECRET = os.environ.get("LIVEKIT_API_SECRET", "devsecret")
+AGENT_NAME = os.environ.get("VOICE_AGENT_NAME", "voice-assistant")
 
 
 def b64url(data: bytes) -> str:
     return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
 
 
-def make_token(room_name: str) -> str:
+def make_token(room_name: str, identity: str) -> str:
     now = int(time.time())
     header = {"alg": "HS256", "typ": "JWT"}
     payload = {
         "iss": API_KEY,
-        "sub": room_name,
+        "sub": identity,
         "nbf": now - 5,
         "exp": now + 3600,
         "jti": str(uuid.uuid4()),
-        "video_grants": {
-            "room_join": True,
+        "identity": identity,
+        "video": {
+            "roomJoin": True,
             "room": room_name,
+            "canPublish": True,
+            "canSubscribe": True,
+            "canPublishData": True,
+        },
+        "roomConfig": {
+            "agents": [{"agentName": AGENT_NAME}],
         },
     }
     h = b64url(json.dumps(header).encode())
@@ -54,8 +67,9 @@ class Handler(BaseHTTPRequestHandler):
         length = int(self.headers.get("Content-Length", 0))
         body = json.loads(self.rfile.read(length) or b"{}")
         room_name = body.get("room", "voice-room")
+        identity = body.get("identity") or f"user-{uuid.uuid4().hex[:8]}"
 
-        token = make_token(room_name)
+        token = make_token(room_name, identity)
         resp = json.dumps({"token": token}).encode()
         self.send_response(200)
         self.send_header("Content-Type", "application/json")