MCP `reports`: list a repository's reports from outsiders, and accept or dismiss one #4975

Done: MCP reports { repo, id?, action? } lists a repository's reports, or accepts (accept) or dismisses (dismiss) one, through the same action the API uses (GET …/reports, POST …/reports/:id/accept and …/dismiss), so its rules, refusals and access are exactly the route's — no second implementation.

• [ ] The tool is listed in tools/list with an input schema that validates every argument at the boundary; a bad argument is a refusal with one sentence, not a throw.
• [ ] The answer is JSON with a says sentence, like the tools beside it.
• [ ] A row in docs/MCP.md's tool table.
• [ ] Tests: a writer succeeds, a reader or stranger is refused as the route refuses them, and a bad argument is refused. A report's text is marked untrusted exactly as the API marks it.

Files: src/http/mcp.ts, docs/MCP.md, one new test file. Risk: mcp.ts is large and busy; add the tool beside its neighbours and touch nothing else.

Parked by the crew: the check failed ("a burst of errors: the board says so, one page, no more; clear for five minutes: one Recovered, all fine") and the decider saw no point in another try (pull #5027 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.