feat(mcp): snapshot read tools

[andypalmi]

Summary

Adds the phase 1 read-only snapshot tools to forge/ee/lib/mcp/tools/snapshots.js:

• platform_get_hosted_instance_snapshot - GET /api/v1/projects/:instanceId/snapshots/:snapshotId
• platform_get_remote_instance_snapshot - GET /api/v1/devices/:deviceId/snapshots/:snapshotId
• platform_get_snapshot - GET /api/v1/snapshots/:id
• platform_get_snapshot_full - GET /api/v1/snapshots/:id/full
• platform_get_instance_device_settings - GET /api/v1/projects/:instanceId/devices/settings

All tools are annotated readOnlyHint: true, destructiveHint: false.

Allow-lists the backing scopes for the user:expert-mcp token type in forge/routes/auth/permissions.js:
project:snapshot:read, device:snapshot:read, snapshot:meta, snapshot:full.

Base is feat/mcp-tools-shared-schemas since this depends on the shared pagination schema fragments; it will retarget to main once that PR merges.

Closes #7687

Consolidation notes

platform_list_instance_target_devices is dropped: the unified platform_list_remote_instances tool already lists a hosted instance's device-group members via its hostedInstanceId argument, so a separate tool would duplicate it.

Test plan

• eslint on changed files
• mocha on changed files

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.35%. Comparing base (68641fb) to head (6d7de1a).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7720      +/-   ##
==========================================
+ Coverage   76.19%   76.35%   +0.15%     
==========================================
  Files         443      443              
  Lines       23726    23731       +5     
  Branches     6314     6314              
==========================================
+ Hits        18079    18120      +41     
+ Misses       5647     5611      -36     

Flag	Coverage Δ
backend	76.35% <100.00%> (+0.15%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[andypalmi]

@cstns reworked the snapshot read tools in 49a1cad based on your review, taking a slightly different route than the literal suggestions:

• Consolidated the get and list tools so hosted and remote are no longer split. platform_get_hosted_instance_snapshot and platform_get_remote_instance_snapshot are gone; platform_get_snapshot (the owner-agnostic /snapshots/:id route) is now the single get tool, since it resolves the owner from the snapshot itself. The two list tools are merged into platform_list_instance_snapshots with an instanceType ('hosted' | 'remote') discriminator, matching how platform_get_team_instance_counts and the other twins are shaped.
• On the rename note: I kept platform_get_snapshot rather than renaming it to hosted, because /snapshots/:id serves both hosted and device snapshots, so a "hosted" name would be misleading. Clarified the description instead.
• On the env exposure: only platform_get_snapshot_full returns env values (the metadata tools do not). It now blanks the values of hidden env vars while keeping visible ones, mirroring the template endpoint's behaviour, so secrets are not handed over while the keys stay visible.

Let me know if you'd prefer different naming.

[andypalmi]

Follow-up in 6d7de1a, continuing the consolidation and picking up your last comment:

• Merged the two create tools into platform_create_instance_snapshot, same instanceType ('hosted' | 'remote') shape as the list tool. The remote reachability note (device must be online, check status first) is now conditional in the description.
• Renamed platform_get_instance_device_settings to platform_get_hosted_instance_device_target_snapshot. The route only returns { targetSnapshot } (the snapshot the instance's assigned devices are set to deploy), so the old "device settings" name read as settings of a device. Title and description now name what it actually returns.
• Updated the one reference to the old create tool name in platform_get_remote_instance_status so it stays consistent.

Snapshot read/create tools are now: platform_list_instance_snapshots, platform_create_instance_snapshot, platform_get_snapshot, platform_get_snapshot_full, platform_get_hosted_instance_device_target_snapshot.