A test pins MCP `ssh_keys`: list, add and remove only your own keys, an `rw` token to change, an unknown action refused #7146

src/http/mcp/tools/ssh_keys.ts refuses invalid_action, and no test names it. Each case calls the tool through /mcp with a real token, as test/mcp.test.ts does.

Done:

• [ ] A new test: with an rw token, a person adds a key, sees it listed, and removes it by id.
• [ ] Removing another account's key id fails with the API's refusal, and that key stays.
• [ ] Adding with a read-only token is refused by scope, and nothing is stored.
• [ ] action: "rotate" is invalid_action.
• [ ] A malformed key line gets the API's refusal.

Files: test/mcp-ssh-keys.test.ts

If the test finds the behaviour wrong, fix the tool in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.