docs(authorization): MCP bulk relations and indexer guardrails

[kkopanidis]

Summary

Agents provisioning ReBAC need bulk relation grants and index recovery via MCP, but the existing admin routes lacked safety-oriented descriptions in tool metadata. This PR enriches route description fields for POST /authorization/relations/many and POST /authorization/indexer/reconstruct so Hermes MCP tools (post_authorization_relations_many, post_authorization_indexer_reconstruct) surface batching guidance and destructive-rebuild warnings to agents.

• POST /authorization/relations/many — documents body shape (subject, relation, resources[]), async indexing, preference for single-create, ResourceDefinition validation, and batch size guidance
• POST /authorization/indexer/reconstruct — documents soft semantics (default hard wipe), async behavior, and requirement to try soft: true first with explicit user confirmation before soft: false

No route handler or mcp flag changes. Database schemas/import and introspection/* routes remain excluded from MCP.

Test plan

• Connect MCP with ?modules=authorization and call tools/list
• Confirm post_authorization_relations_many and post_authorization_indexer_reconstruct are listed
• Invoke post_authorization_relations_many with JSON body { subject, relation, resources: [...] } → relations created
• Invoke post_authorization_indexer_reconstruct with { "soft": true } → returns "ok"
• Confirm database import/introspection tools are absent from tools/list