A test pins reading an app's egress grants through MCP: an admin-scope token only, and the same answer as the API #7061

The MCP tool egress_grants (src/http/mcp/tools/egress_grants.ts) has no test of its own; only the tool list names it.

Done:

• [ ] A new test seeds an app whose forge.json asks for two private host:port destinations, one of them granted. With an admin-scope token, egress_grants { repo } lists both and marks which is granted, equal to GET /api/v1/repos/:owner/:name/egress-grants.
• [ ] A read-only or read-write token is forbidden ("egress grants need an admin-scope token").
• [ ] A repository the caller cannot read is not_found.

Files: test/mcp-egress-grants-read.test.ts

If the test finds the behaviour wrong, fix the tool in the same pull and say so.

If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the tests this names.