MCP `app_env`: list, set and unset an app's environment variables, with the same rules as the API #4754

Intent: an agent configures an app's environment through MCP, never reading back more than the API does.

Done:

• [ ] src/http/mcp.ts has an app_env tool, placed right after limits, taking repo, action (list | set | unset), name, value and scope (all | production | preview) and calling listAppEnv, setAppEnvVar and deleteAppEnvVar exactly as the API's /app/env routes do (admin only)
• [ ] list answers what GET /app/env answers and nothing more; a value is never echoed in an error
• [ ] docs/MCP.md has its row beside limits
• [ ] test/mcp-app-env.test.ts: an admin sets a variable per scope, lists it and unsets it; a writer who is not admin is refused; a bad name is refused with the API's error

Risk: values can be secrets — the test asserts the set call's answer does not contain the value unless the API's does.

Risks: test/mcp-size.test.ts holds tools/list under a 37,000-byte headroom; keep the description to one short sentence, and if the headroom fails after a rebase, shorten this tool's own description, not another's. Other MCP tools are being added in parallel: put this one exactly where named so the hunks do not meet.