MCP `passkeys`: list the caller's own passkeys, with name, when added and when last used #5479

For: "which devices can sign in as me?" is answerable from a harness, beside tokens (#5475) and sessions (#5147). /settings/passkeys reads listPasskeys(db, user.id) (src/web/pages/passkeys.ts:69).

Done:

• [ ] A read-only tool passkeys, for a person only (an agent has none and is refused), answers each passkey from listPasskeys(db, caller.id): id, name, created, last used. Never the credential id's raw bytes or the public key.
• [ ] test/mcp-passkeys.test.ts covers three cases: a person with two passkeys sees both; another person's are never listed; an agent token is refused. Each fails without the tool.
• [ ] One row in docs/MCP.md; a write is marked as one in tools/list's annotations.
• [ ] Before pushing, run test/mcp-passkeys.test.ts, test/mcp.test.ts, test/mcp-docs.test.ts, test/mcp-size.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-passkeys.test.ts. Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence.

Parked by the crew: the check stayed red through 2 automatic tries (pull #5490 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the preview's deploy failed and the decider saw no point in another try (pull #5746 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #5490 closed)
2. the preview's deploy failed and the decider saw no point in another try (pull #5746 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #5753. Both tries added a new tool and ran into test/mcp-size.test.ts headroom; the cuts made to fit broke other descriptions. #5753 makes it kind: "passkeys" on whoami_can, the existing tool about the caller, as docs/MCP.md "Room for a new tool" asks.