feat(mcp): team read tools

[andypalmi]

Summary

Phase 1 read-only MCP tools for the team resource, added to forge/ee/lib/mcp/tools/teams.js. This covers team lookups, membership, the team audit log, and team-scoped data and packages:

• platform_get_team_by_slug - GET /teams/slug/:teamSlug
• platform_get_team_instance_counts - GET /teams/:teamId/instance-counts
• platform_check_team_slug_availability - POST /teams/check-slug
• platform_get_team_membership - GET /teams/:teamId/user
• platform_list_team_members - GET /teams/:teamId/members
• platform_list_team_invitations - GET /teams/:teamId/invitations
• platform_get_team_audit_log - GET /teams/:teamId/audit-log
• platform_export_team_audit_log - GET /teams/:teamId/audit-log/export
• platform_list_team_npm_packages - GET /teams/:teamId/npm/packages
• platform_list_team_git_tokens - GET /teams/:teamId/git/tokens
• platform_list_library_entries - GET /storage/library/:libraryId/*

Each tool describes the team resource, so the membership tools and the team-data tools all fold into teams.js, following the one-file-per-resource convention (rather than separate members.js/teamData.js files). All tools are annotated readOnlyHint: true, destructiveHint: false. platform_check_team_slug_availability uses POST but performs no mutation, so it is annotated read as well.

The team-data surfaces (npm, gitIntegration, shared-library) are plan-gated; the tools turn a feature-disabled 404 into a clear "feature not enabled" message.

Scopes allow-listed on IMPLICIT_TOKEN_SCOPES['user:expert-mcp'] in forge/routes/auth/permissions.js:

• team:user:list
• team:user:invite
• team:audit-log
• team:packages:read
• team:git:tokens:list
• library:entry:list
• team:create

(team:read was already present.)

Tools that describe a different resource are filed elsewhere: instance lists in instances.js, application statuses in applications.js, provisioning tokens in devices.js, and team types in platform.js. Their backing scopes move with them.

FlowFuse Tables tools (platform_list_team_databases, platform_get_team_database, platform_list_database_tables, platform_get_database_table, platform_query_database_table_data) are split out to #7990, tracked by #7989.

Write, destructive, and admin-only tools for this resource are out of scope for this PR.

Closes #7693

Test plan

• eslint on changed files passes
• Tool modules load and export the expected tool definitions (verified with a local require smoke check)
• CI

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.73%. Comparing base (103f9ae) to head (b675d3f).

Additional details and impacted files

@@                        Coverage Diff                        @@
##           feat/mcp-tools-shared-schemas    #7722      +/-   ##
=================================================================
+ Coverage                          75.41%   75.73%   +0.32%     
=================================================================
  Files                                426      426              
  Lines                              22551    22592      +41     
  Branches                            5949     5950       +1     
=================================================================
+ Hits                               17006    17110     +104     
+ Misses                              5545     5482      -63     

Flag	Coverage Δ
backend	75.73% <100.00%> (+0.32%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.