MCP `tokens`: list the caller's own API tokens, with name, scope and when last used, never the secret #5475

For: "what can reach my forge on my behalf?" is answerable from a harness. GET /api/v1/tokens (src/http/api.ts:2173) and /settings/tokens (listTokens, src/core/tokens.ts) show it; MCP does not.

Done:

• [ ] A read-only tool tokens, for the caller only, answers each token from listTokens(db, caller.id) with the same fields the API route returns: id, name, scope, created and last used. Never the token value or its hash.
• [ ] test/mcp-tokens.test.ts covers two cases: a person with two tokens sees both, and the answer's JSON contains neither secret; another person's tokens are never listed. Each fails without the tool.
• [ ] One row in docs/MCP.md; a write is marked as one in tools/list's annotations.
• [ ] Before pushing, run test/mcp-tokens.test.ts, test/mcp.test.ts, test/mcp-docs.test.ts, test/mcp-size.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-tokens.test.ts. Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence.