Gate MCP on coverage (is_covered), not just authentication

MCP access (Claude Desktop, claude.ai, and any other connected agent) now requires an active plan or trial, not just a valid login — a signed-in account whose trial has expired or that never subscribed gets a clear "subscription required" message instead of being able to keep capturing and reading memories indefinitely. Covered users, including active trials and paid plans, see no change; logging in and paying still work the same way.