feat(mcp): team read tools

[andypalmi]

Summary

Phase 1 read-only MCP tools for the team resource, added to forge/ee/lib/mcp/tools/teams.js. This covers team lookups, membership, the team audit log, and team-scoped data and packages:

• platform_get_team_by_slug - GET /teams/slug/:teamSlug
• platform_get_team_instance_counts - GET /teams/:teamId/instance-counts
• platform_check_team_slug_availability - POST /teams/check-slug
• platform_get_team_membership - GET /teams/:teamId/user
• platform_list_team_members - GET /teams/:teamId/members
• platform_list_team_invitations - GET /teams/:teamId/invitations
• platform_get_team_audit_log - GET /teams/:teamId/audit-log
• platform_export_team_audit_log - GET /teams/:teamId/audit-log/export
• platform_list_team_npm_packages - GET /teams/:teamId/npm/packages
• platform_list_team_git_tokens - GET /teams/:teamId/git/tokens
• platform_list_library_entries - GET /storage/library/:libraryId/*

Each tool describes the team resource, so the membership tools and the team-data tools all fold into teams.js, following the one-file-per-resource convention (rather than separate members.js/teamData.js files). All tools are annotated readOnlyHint: true, destructiveHint: false. platform_check_team_slug_availability uses POST but performs no mutation, so it is annotated read as well.

The team-data surfaces (npm, gitIntegration, shared-library) are plan-gated; the tools turn a feature-disabled 404 into a clear "feature not enabled" message.

Scopes allow-listed on IMPLICIT_TOKEN_SCOPES['user:expert-mcp'] in forge/routes/auth/permissions.js:

• team:user:list
• team:user:invite
• team:audit-log
• team:packages:read
• team:git:tokens:list
• library:entry:list
• team:create

(team:read was already present.)

Tools that describe a different resource are filed elsewhere: instance lists in instances.js, application statuses in applications.js, provisioning tokens in devices.js, and team types in platform.js. Their backing scopes move with them.

FlowFuse Tables tools (platform_list_team_databases, platform_get_team_database, platform_list_database_tables, platform_get_database_table, platform_query_database_table_data) are split out to #7990, tracked by #7989.

Write, destructive, and admin-only tools for this resource are out of scope for this PR.

Closes #7693

Test plan

• eslint on changed files passes
• Tool modules load and export the expected tool definitions (verified with a local require smoke check)
• CI

[codecov]

Codecov Report

❌ Patch coverage is 97.61905% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 76.21%. Comparing base (a8f760b) to head (903947d).

Files with missing lines	Patch %	Lines
forge/ee/routes/sharedLibrary/index.js	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7722      +/-   ##
==========================================
+ Coverage   76.17%   76.21%   +0.04%     
==========================================
  Files         440      440              
  Lines       23604    23645      +41     
  Branches     6285     6286       +1     
==========================================
+ Hits        17981    18022      +41     
  Misses       5623     5623              

Flag	Coverage Δ
backend	76.21% <97.61%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.