A test pins MCP `cloud_account`: an unknown verb is refused, and every verb needs an admin with an admin-scope token #7151

src/http/mcp/tools/cloud_account.ts refuses bad_verb, and no test names it. Each case calls the tool through /mcp with a real token, as test/mcp.test.ts does.

Done:

• [ ] A new test with a stubbed provider: an admin with an admin-scope token runs attach, rename and remove, and each answers a one-line says. No token value appears in any answer.
• [ ] verb: "delete" is bad_verb.
• [ ] A non-admin, and an admin with an rw token, are refused for every verb, and the account is unchanged.

Files: test/mcp-cloud-account.test.ts

If the test finds the behaviour wrong, fix the tool in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.