MCP: add stats and today tools for surface parity

[claude]

🤖 Agent-Generated PR

Closes #18
Agent Used: Claude Code
Complexity: low

---

Summary

Adds stats and today MCP tools to journal mcp, returning the same stable JSON shape as journal stats --json / journal today --json. Rounds out the agent surface for "how's my note volume" and "what does my day look like" queries.

Implementation Notes

• Followed the existing mcp.AddTool + toolHandler pattern used by all other tools.
• Added empty input structs (statsInput, todayMCPInput) consistent with how the SDK resolves typed handlers with no parameters.
• mcpStats delegates to gatherStats(ctx, cfg, now()) and marshals the StatsReport.
• mcpToday delegates to gatherToday(ctx, cfg) (discarding the raw markdown string; the MCP consumer gets the structured todayReport JSON).
• No new logic introduced — all gather/aggregate work was already in cmd/stats.go and cmd/show.go.

Changes

• cmd/mcp.go: register stats and today tools; add mcpStats and mcpToday handlers; add statsInput and todayMCPInput input types.
• cmd/mcp_test.go: TestMCPStatsReturnsJSON and TestMCPTodayReturnsJSON covering JSON shape and key fields.

Testing

Automated:

• Unit tests added/updated
• Integration tests added/updated
• All existing tests pass

Manual testing performed:

• Ran go test -p 1 -run "TestMCPStats|TestMCPToday" ./cmd/ -v — both pass.
• Ran make test — all packages green.
• Ran make build and make vet — clean.

---

Review Checklist

Correctness

• Code actually solves the issue
• Acceptance criteria are met
• Edge cases handled

Code Quality

• Follows existing codebase patterns
• Follows project coding standards
• Naming conventions consistent
• No unnecessary complexity
• Comments where needed (but code is self-documenting)

Security

• Input validation present
• No exposed secrets or credentials
• Data properly sanitized/escaped
• Authentication/authorization checks where needed

Performance

• No obvious N+1 queries
• Reasonable algorithmic complexity
• Caching used where appropriate
• No blocking operations in request lifecycle

Tests

• Tests actually test behavior (not just coverage)
• Edge cases covered
• Failure modes tested

---

Reviewer Notes

todayMCPInput is named to avoid collision with todayReport and todayJSON in show.go. All other tool registrations use a descriptive Input suffix on their struct names.

[claude]

Retro: no durable lesson (merged clean / one-off).