MCP `parent_unlink`: unlink the caller's account from its parent forge's sign-in, refused when it is the last way in, as Settings does #5483

For: in the fork tree, an owner can stop signing in through the parent forge from a harness, with the guard that keeps them from locking themselves out. parentUnlink (src/web/pages/account.ts) calls unlinkParent(db, user.id, issuer). It refuses with LAST_WAY_IN when no other way in remains, and appends account.parent_unlinked.

Done:

• [ ] A tool parent_unlink with no arguments, for a person, refused unless the token's scope is admin. It runs the same logic: no parent issuer, or nothing linked, is "Nothing to unlink."; the last way in is LAST_WAY_IN's sentence; success appends the same bus event and answers { says: "Unlinked." }. Export LAST_WAY_IN if needed; do not reword it.
• [ ] test/mcp-parent-unlink.test.ts covers four cases: an account with a password and a parent link is unlinked; one whose parent link is its only way in is refused, and stays linked; nothing linked says so; a read-write token is refused. Each fails without the tool.
• [ ] One row in docs/MCP.md, marked as a write.
• [ ] Before pushing, run the new test, test/mcp.test.ts, test/mcp-docs.test.ts, test/mcp-size.test.ts and bun x tsc --noEmit.

Files: src/http/mcp.ts, docs/MCP.md, test/mcp-parent-unlink.test.ts, and src/web/pages/account.ts only to export the sentence. Risk: test/mcp-size.test.ts caps tools/list, so keep the description to one short sentence.