A settings change is on the trail with who and from what to what, and `events` filters by kind #7653

Part of #7640. When Flow only went on, and who turned it on, is one read.

Done when:

• [ ] repo.settings_updated carries { changed: { flowOnly: { from, to }, … } } and names the alarm when the forge itself changed it
• [ ] MCP events and /:owner/:name/events take kind (e.g. repo.settings_updated) and still page with next_cursor
• [ ] A test flips flowOnly twice and reads both events back, newest first, with the actor and from/to

Files: src/actions/repos.ts, src/core/events_page.ts, src/http/mcp/tools/events.ts, test/settings-trail.test.ts

Risks: Secret settings must never put values in the payload: only that they changed.

Fits: a builder