MCP `snapshot_now`: take a snapshot now, as the Backups page's button does, for a forge admin #5422

For: before a risky change, the owner can say "snapshot first" from any harness. The page's "take one now" (backupsNow, src/web/pages/backups.ts:624) has no MCP or API twin.

Done:

• [ ] A tool snapshot_now with no arguments, admin only (refused in requireAdmin's words), calls snapshotsOf(ctx.app)?.now(), the same service the page uses. It answers { name, repos, apps, bytes, says }, with says worded as the page's flash. With no store it answers the page's sentence "This forge has nowhere to put a snapshot." A failure is a one-sentence refusal, never a throw.
• [ ] It is marked as a write in tools/list's annotations, as the other writes are.
• [ ] One row in docs/MCP.md.
• [ ] test/mcp-snapshot-now.test.ts covers three cases: an admin on a forge with a local store takes one, and it is in the store's listing after; no store answers the sentence; a non-admin is refused. Each fails without the tool.
• [ ] Before pushing, run the new test, test/mcp.test.ts, test/mcp-docs.test.ts and test/mcp-size.test.ts.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-snapshot-now.test.ts. Risk: #5415 (MCP backups) edits the same file nearby. Place this tool right after it; if it has not landed, place it after audit.