MCP `telemetry_grant`: grant or take back an agent's telemetry:read, with the same rule as the Telemetry page #5462

For: the owner decides from a harness which agent may read the forge's telemetry. telemetrySet (src/web/pages/telemetry.ts) calls setTelemetryGrant, which refuses anyone but an agent account, behind the page's owner check.

Done:

• [ ] A tool telemetry_grant { agent, on } calls setTelemetryGrant(app, user, agent, on) behind the same owner check. It answers { agent, on, says }, with says worded as the page's flash. Granting to a person is refused with "Only an agent account can be granted telemetry:read."
• [ ] test/mcp-telemetry-grant.test.ts covers four cases: the owner grants an agent, and the agent's telemetry read then succeeds; taking it back makes it fail again; a person's name is refused; a non-owner is refused. Each fails without the tool.
• [ ] One row in docs/MCP.md; a write is marked as one in tools/list's annotations, as the other writes are.
• [ ] Before pushing, run test/mcp-telemetry-grant.test.ts, test/mcp.test.ts, test/mcp-docs.test.ts, test/mcp-size.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-telemetry-grant.test.ts. Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence.