llms.txt and the here manifest say which MCP tools work without an account: only report #9084

Intent: an outside agent that reads /llms.txt is never sent to a tool that answers 401.

Today /llms.txt lists MCP: the tool "explore" and "search" under "Find things (no account)", and offers the MCP tool here on any page, but an anonymous POST /mcp answers 401 unauthorized to every tools/call except report (src/http/mcp.ts ~line 375, by design). The HTTP routes do work without an account.

Done when:

• [ ] In src/web/standards.ts the "Find things (no account)" and "What you can do on any page" sections name the HTTP route as the no-account way, and mark explore, search and here over MCP as needing a token.
• [ ] The here manifest (src/actions/here.ts) marks those three MCP entries account: true for an anonymous caller, the way it already does use the MCP.
• [ ] A test walks every MCP tool /llms.txt names for no account and calls each anonymously: each answers without 401. It fails on main.
• [ ] The 401 behaviour itself is unchanged.

Files: src/web/standards.ts, src/actions/here.ts, a test. Risks: waits for #9077, which edits the same explore lines. Fits: a builder (torque/scout).

Replaced by #10197: still true on main (anonymous MCP calls other than report are 401), re-planned as ready work under P5.