MCP `backups_destination`: set or forget where snapshots go, with the same validation as the Backups page; a credential is written, never read back #5441

For: a new forge gets an off-machine backup from a harness, without opening /settings/backups. saveDestination and forgetDestination (src/actions/destination.ts) back the page's form.

Done:

• [ ] A tool backups_destination { action: "set"|"forget", …DestinationInput fields }, admin only. set validates with invalidField, so a bad field is the page's refusal, then calls saveDestination. forget calls forgetDestination. The answer is { kind, place, says }: no credential, key or secret field ever appears in it, nor in the run log line.
• [ ] test/mcp-backups-destination.test.ts covers four cases: an admin sets a local destination and /settings/backups shows it; a bad field is refused; forget clears it; a non-admin is refused. The answer for a destination given a secret does not contain that secret anywhere. Each fails without the tool.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-backups-destination.test.ts. Risk: secrets pass through the MCP request body only. Never log arguments.

• [ ] One row in docs/MCP.md, marked as a write in tools/list's annotations as the other writes are.
• [ ] Before pushing, run the new test, test/mcp.test.ts, test/mcp-docs.test.ts and test/mcp-size.test.ts. A red test elsewhere that main also has is named in the pull.

Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence.