Document the MCP surface — ask the system what is late #21

Every ObjectStack deployment is an MCP server on by default. Post-v1 — v1 is M1+M2.

Scope

docs/mcp.md: how to point a client at a Duly deployment, which objects and actions become tools, and how the caller's own permissions and RLS still apply.

Worked questions that should just work, with the actual exchange shown:

• "What is late in the Rotterdam plant?"
• "Which of my duties are due in the next two weeks?"
• "Show me open tasks nobody has touched in a month."
• "How many quarterly duties does the compliance officer position carry?"

Why this is a product feature and not a footnote

It is a natural-language interface to the manager's whole question, and it costs us documentation rather than a chat UI. Worth saying out loud in the README and the positioning — it is a genuine differentiator against every tool in the category, and it is already built.

Constraints

• Show that queries run under the caller's permissions. The reassurance matters more than the capability.
• Do not surface duly_log_entry in any example. The permission model already blocks it; the docs should not teach anyone to try.
• Cover turning it off (OS_MCP_SERVER_ENABLED=false) for customers whose policy requires it.