MCP `notify` reads, sets or turns off the caller's phone notify URL, needing what the Settings page needs #6850

Replaces #5461. Pull #5517 has the tool; finish on it while it is open (rebase on main, where the MCP size test's headroom is 38,500 bytes, and drop its unrelated description rewrite), else start fresh.

Done:

• [ ] Tool notify { url? } for a signed-in person, never an agent. With no argument it answers whether a URL is set, as its host only. With url it saves through setNotifyUrl (same refusals, NOTIFY_ERRORS' words); empty turns it off; success appends the page's bus event.
• [ ] Saving or clearing needs the same token scope the page's readForm(ctx, "admin") needs; a narrower token is refused and nothing is written.
• [ ] test/mcp-notify.test.ts: set then read back the host; a private-network address refused; empty turns off; an agent token refused; a narrow-scope token refused. test/mcp-size.test.ts passes.

Files: src/http/mcp/tools/notify.ts (or the tool registry main uses), docs/MCP.md, the test.

Before pushing: bun x tsc --noEmit and the tests you add or touch; bun scripts/design-lint.ts if src/web/ changes. Small and single-purpose; tests never read the wall clock — pass now in.