feat: Add weDocs Abilities API and MCP integration guide

[Copilot]

Summary

Introduces a centralized Abilities API that lets MCP clients (and any external integration) discover exactly what the currently authenticated user is allowed to do before making mutating REST calls.

Changes

New files

File	Purpose
includes/API/AbilitiesPolicy.php	Single source of truth for all weDocs permission checks. Provides global_abilities(), doc_abilities($id), resolve_read_access($post), and can($key) static helpers. Exposes wedocs_global_abilities and wedocs_doc_abilities filters so weDocs Pro and third-party plugins can extend the ability set.
includes/API/AbilitiesApi.php	REST controller. Registers GET /wp/v2/docs/abilities (global) and GET /wp/v2/docs/{id}/abilities (per-doc). Both endpoints are publicly accessible and return false for all protected abilities when called without credentials. JSON schemas included.
docs/mcp-integration.md	Comprehensive MCP integration guide (abilities matrix, auth options, endpoint reference, onboarding flow with pseudocode, tool–ability mapping table, graceful denial handling, public-vs-authenticated flows, filter extension API, migration notes).

Modified files

File	Change
includes/API/API.php	Registers AbilitiesApi in constructor. Delegates sortable_item_permissions_check, delete_item_permissions_check, get_promotional_notice_check, ai_generate_permissions_check, ai_upload_permissions_check, and get_promotional_notice() to AbilitiesPolicy.
includes/API/SettingsApi.php	get_items_permissions_check and create_item_permissions_check delegate to AbilitiesPolicy::can('settings.read/write').

Abilities matrix (summary)

Ability	Required
docs.read, docs.search, summary.read/generate, feedback.submit, contributors.read	Public (always true)
docs.create/edit/delete/publish/sort, ai.generate, summary.save/delete	edit_docs
docs.read_private	read_private_docs
docs.edit_others	edit_others_docs
docs.publish	publish_docs
settings.read/write, ai.configure, notices.manage	manage_options
ai.upload_image	edit_docs + upload_files + Pro active
helpfulness.vote	Logged in

Backward compatibility

All existing REST endpoint behaviors are unchanged. The permission_callbacks now delegate to AbilitiesPolicy which resolves the same current_user_can() calls as before.