MCP `subscription_add`: put a Claude account in the crew's pool, its token write-only, with the same refusals as the Subscriptions page #5465

For: the owner adds a model account from a harness the way they add a sealed secret (secrets: values are write-only). subscriptionAdd (src/web/pages/subscriptions.ts) calls addSubscription and words each refusal (invalid_name, name_taken, invalid_token, invalid_api_base).

Done:

• [ ] A tool subscription_add { name, token, apiBase? }, admin only, calls addSubscription with createdBy set to the caller. Each refusal is the page's sentence, moved to one shared place so both doors use it. It answers { id, name, says }. The token is never in the answer, the run log or an event.
• [ ] test/mcp-subscription-add.test.ts covers four cases: an admin adds one and it is listed on the page; a taken name is refused; a bad token is refused with the page's words; and the answer and the event log never contain the token. Each fails without the tool.
• [ ] One row in docs/MCP.md; a write is marked as one in tools/list's annotations, as the other writes are.
• [ ] Before pushing, run test/mcp-subscription-add.test.ts, test/mcp.test.ts, test/mcp-docs.test.ts, test/mcp-size.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-subscription-add.test.ts. Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence. Never log arguments.