MCP `sync`: sync a mirror now, or reconnect its origin, with the same rules as the API #7010

This pull adds an MCP sync tool that syncs a mirror now, or reconnects its origin, with the API's rules. I merged the latest main into the branch (no conflicts) and pushed it as 87cc5113. The type check is clean. The tests that cover this change pass: mcp-sync, mcp, mcp-size, mcp-tools and origin-app-words. I did not run the whole suite, and the forge's check has not run on this push yet.

The issue has no new comments. It still carries only the earlier "parked: check stayed red" note. The last red check, on the origin-unreachable sentence, was fixed in 8b14e6e8.

• Sync: sync { repo } calls the same action as POST …/sync, for the same caller, so the API's permission checks apply. A fork is refused with not_a_mirror and pointed to take_updates. A reader is refused.
• Reconnect: sync { repo, originId } calls the action behind …/origin/reconnect. It needs an admin-scope token, and a refusal says to be an admin of the repository.
• Placement: the tool is src/http/mcp/tools/sync.ts, and docs/MCP.md has its row. The description is one short sentence to keep tools/list small.
• Tests: test/mcp-sync.test.ts covers an admin syncing a mirror with a faked origin and no network. It also covers a non-mirror refused, a reader refused, and the reconnect and fork paths.

I did not change the API routes.

To try it, call sync with { "repo": "owner/name" } from an rw token on a mirror. Add originId with an admin token to reconnect a frozen mirror.

Closes #4903

This pull adds an MCP sync tool that syncs a mirror now, or reconnects its origin, with the API's rules. I merged the latest main into the branch (no conflicts) and pushed it as 87cc5113. The type check is clean. The tests that cover this change pass: mcp-sync, mcp, mcp-size, mcp-tools and origin-app-words. I did not run the whole suite, and the forge's check has not run on this push yet.

The issue has no new comments. It still carries only the earlier "parked: check stayed red" note. The last red check, on the origin-unreachable sentence, was fixed in 8b14e6e8.

• Sync: sync { repo } calls the same action as POST …/sync, for the same caller, so the API's permission checks apply. A fork is refused with not_a_mirror and pointed to take_updates. A reader is refused.
• Reconnect: sync { repo, originId } calls the action behind …/origin/reconnect. It needs an admin-scope token, and a refusal says to be an admin of the repository.
• Placement: the tool is src/http/mcp/tools/sync.ts, and docs/MCP.md has its row. The description is one short sentence to keep tools/list small.
• Tests: test/mcp-sync.test.ts covers an admin syncing a mirror with a faked origin and no network. It also covers a non-mirror refused, a reader refused, and the reconnect and fork paths.

I did not change the API routes.

To try it, call sync with { "repo": "owner/name" } from an rw token on a mirror. Add originId with an admin token to reconnect a frozen mirror.