/api/v1/here and /.well-known/mcp.json agree on which MCP tools need no token #8358

/api/v1/here and /.well-known/mcp.json now agree: report is the only MCP tool that needs no token. contribute needs one over /mcp, so here was the one that changed. tsc and the gate script are clean, and the new test plus mcp-card, here-manifest and mcp-size pass. I did not run the full suite.

• What /mcp allows: without a token the gate answers only report; every other tool, contribute included, gets 401. I didn't widen anything.
• One list: TOKEN_FREE_TOOLS in src/core/mcp_card.ts now feeds tokenFreeTools in the card and the account:false marks in here. here marks an MCP tool account:false only if it is on that list.
• Fix in here: the "see how to help build this forge" row (contribute) no longer says account:false. It keeps its GET /api/v1/contribute route and its mcp: "contribute" field. The HTTP route itself is open, but the row now makes no claim either way. I updated the matching expectation in test/here-manifest.test.ts.
• New test: test/token-free-tools.test.ts calls every tool on the list over /mcp with no token and gets an answer, not 401. It checks that every tool off the list does get 401. It also checks that the card and here print exactly that list.
• Not done: the gate in src/http/mcp.ts still matches report by its own constant (REPORT_TOOL.name) rather than by the list. The new test asserts the two stay in step, but a future second token-free tool would still need its own handler.

Closes #8337

/api/v1/here and /.well-known/mcp.json now agree: report is the only MCP tool that needs no token. contribute needs one over /mcp, so here was the one that changed. tsc and the gate script are clean, and the new test plus mcp-card, here-manifest and mcp-size pass. I did not run the full suite.

• What /mcp allows: without a token the gate answers only report; every other tool, contribute included, gets 401. I didn't widen anything.
• One list: TOKEN_FREE_TOOLS in src/core/mcp_card.ts now feeds tokenFreeTools in the card and the account:false marks in here. here marks an MCP tool account:false only if it is on that list.
• Fix in here: the "see how to help build this forge" row (contribute) no longer says account:false. It keeps its GET /api/v1/contribute route and its mcp: "contribute" field. The HTTP route itself is open, but the row now makes no claim either way. I updated the matching expectation in test/here-manifest.test.ts.
• New test: test/token-free-tools.test.ts calls every tool on the list over /mcp with no token and gets an answer, not 401. It checks that every tool off the list does get 401. It also checks that the card and here print exactly that list.
• Not done: the gate in src/http/mcp.ts still matches report by its own constant (REPORT_TOOL.name) rather than by the list. The new test asserts the two stay in step, but a future second token-free tool would still need its own handler.