docs: fold the mcp task 12 token-form steps into the api keys redesign

docs/superpowers/plans/2026-09-08-mcp-server.md

@@ -2297,9 +2297,19 @@ git commit -m "feat: let an agent create steps, workflows and monitors, inert un
 ### Task 12: Token form and agent access panel
 
 **Files:**
-- Modify: `vantage-app/web/app/(app)/settings/` — the API tokens page and its token creation form
 - Modify: `vantage-app/web/app/(app)/settings/license/page.tsx:255-270`
-- Modify: `vantage-app/web/lib/` — the API client's token creation call
+
+> **Scope reduced.** Steps 2 and 4 of this task — the tag restriction field and its
+> chip in the key list — **are already built** by
+> `docs/superpowers/plans/2026-09-08-api-keys-redesign.md`, which redesigned the
+> same surfaces and absorbed them rather than have two plans rewrite one
+> component from opposite ends. Steps 3 and 5 — gating the `mcp:*` scopes and the
+> agent access panel — belong to that plan's Task 7, which waits on this plan's
+> Tasks 6–11. **Only step 1 below is still this task's work.**
+>
+> Note also that the page is not under `settings/`: it is `/tokens`, rendered by
+> `vantage-app/web/app/(app)/tokens/page.tsx`, with its body split across
+> `vantage-app/web/components/apikeys/`.
 
 **Interfaces:**
 - Consumes: the `tag_selector` field on the token create request (Task 4), `license.features.mcp` from the existing licence response.
@@ -2314,7 +2324,7 @@ In `vantage-app/web/app/(app)/settings/license/page.tsx`, beside the existing fe
 
 `licenceResponse.Features` is already a `map[string]bool` built from the licence, so no server change is needed for this to populate.
 
-- [ ] **Step 2: Add the tag restriction field to the token form**
+- [x] ~~**Step 2: Add the tag restriction field to the token form**~~ — done in the API keys redesign, `web/components/apikeys/TagRestriction.tsx`.
 
 Locate the token creation form (grep the settings directory for the scope checkbox list). Add a tag restriction control below the scopes, shown for **every** token regardless of licence — tag scoping is not gated.
 
@@ -2322,15 +2332,15 @@ It offers the tag keys and values already in use across servers, which the fleet
 
 The field sends `tag_selector` as an object of key/value strings, omitted or `{}` when unrestricted.
 
-- [ ] **Step 3: Add the MCP scopes and gate them**
+- [ ] **Step 3: Add the MCP scopes and gate them** — moved to the API keys redesign plan, Task 7.
 
 `mcp:read` and `mcp:write` arrive automatically in the scope list from `GET /api/tokens/scopes`, so no hardcoding is needed. Hide or disable those two entries when `license.features.mcp` is false, matching how console-gated UI is handled elsewhere.
 
-- [ ] **Step 4: Show the restriction in the token list**
+- [x] ~~**Step 4: Show the restriction in the token list**~~ — done in the API keys redesign, `TagChips` in the ledger.
 
 In the token list, render a token's `tag_selector` as a chip beside its scopes, so "what can this credential reach" is answerable at a glance. An unrestricted token shows nothing rather than an empty chip.
 
-- [ ] **Step 5: Add the agent access panel**
+- [ ] **Step 5: Add the agent access panel** — moved to the API keys redesign plan, Task 7.
 
 On the API tokens settings page, add an **Agent access** panel visible only when `license.features.mcp` is true, containing: