MCP `passkey_remove`: remove one of the caller's own passkeys, only with an admin-scope token, as Settings → Passkeys does #5480

For: a lost phone's passkey is removed from wherever the owner is. A stolen read-write token must not be enough to remove the owner's sign-in, so this needs the caller's own admin-scope token, the scope secrets and cloud_account already require.

Done:

• [ ] A tool passkey_remove { id }, refused unless the token's scope is admin and the caller is a person. It calls removePasskey(db, caller.id, id), as passkeyDelete (src/web/pages/passkeys.ts) does, and answers { id, says: "Passkey removed." }. An unknown id, or another person's, is "No such passkey."
• [ ] test/mcp-passkey-remove.test.ts covers three cases: with an admin-scope token the passkey is gone and passkeys no longer lists it; a read-write token is refused, and the passkey stays; another person's id is refused. Each fails without the tool.
• [ ] One row in docs/MCP.md; a write is marked as one in tools/list's annotations.
• [ ] Before pushing, run test/mcp-passkey-remove.test.ts, test/mcp.test.ts, test/mcp-docs.test.ts, test/mcp-size.test.ts and bun x tsc --noEmit. A red test elsewhere that main also has is named in the pull, not a reason to stop.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-passkey-remove.test.ts. Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence.

Planner: this no longer waits for #5479. Its test reads the passkeys with listPasskeys directly, not through the passkeys tool, so either can land first.