What this PR does

Before this PR:
MCP servers installed via protocol (e.g., cherrystudio://) always require user confirmation to trust, even for well-known trusted sources like WPS Notes.

After this PR:
Adds a whitelist mechanism to auto-trust specific MCP server URLs without requiring user confirmation. Currently whitelisted:

• http://127.0.0.1:18930/mcp (WPS Notes)

Why we need it and why it was done in this way

The following tradeoffs were made:

• Hardcoded whitelist vs. user-configurable: Chose hardcoded for security, as allowing user-defined whitelists could be exploited.

The following alternatives were considered:

• Making whitelist configurable via settings: Rejected due to security concerns.

Breaking changes

None

Special notes for your reviewer

The whitelist only applies to SSE-type servers with matching baseUrl. The implementation is minimal and focused.

Checklist

• PR: The PR description is expressive enough and will help future contributors
• Code: Write code that humans can understand and Keep it simple
• Refactor: You have left the code cleaner than you found it (Boy Scout Rule)
• Upgrade: Impact of this change on upgrade flows was considered and addressed if required
• Documentation: A user-guide update was considered and is present (link) or not required. Check this only when the PR introduces or changes a user-facing feature or behavior.
• Self-review: I have reviewed my own code before requesting review from others

Release note

NONE