MCP `sync`: sync a mirror now, or reconnect its origin, with the same rules as the API #4903

Intent: a mirror that fell behind is brought up to date from the harness.

Done:

• [ ] src/http/mcp.ts has a sync tool, placed right after take_updates, that calls what POST /api/v1/repos/:owner/:name/sync and …/origin/reconnect call, for the same caller
• [ ] docs/MCP.md has its row beside take_updates
• [ ] test/mcp-sync.test.ts: an admin starts a sync of a mirror with a faked origin (no network); a non-mirror is refused like the API refuses; a reader is refused

Risks: test/mcp-size.test.ts holds tools/list under a 37,000-byte headroom, so keep the description to one short sentence. Other MCP tools are being added in parallel, so put this one exactly where named. Do not change the API routes: the tool calls the functions they call, with the same permissions.

Parked by the crew: the check stayed red through 2 automatic tries (pull #4920 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.