5.4-a.2 FlowFuse Tables tools

[andypalmi]

Splitting up Team Read tools to implement the FlowFuse Tables as a separate PR

Parent: #7673 (5.4 Teams and membership)
Tool file: forge/ee/lib/mcp/tools/teams.js (extend)

Read tools for the FlowFuse Tables.

readOnlyHint: true.

Tool	Endpoint	Scope	Annotation
platform_list_team_databases	GET /teams/:teamId/databases	team:database:list	read
platform_get_team_database	GET /teams/:teamId/databases/:databaseId	team:database:list	read
platform_list_database_tables	GET /teams/:teamId/databases/:databaseId/tables	team:database:list	read
platform_get_database_table	GET /teams/:teamId/databases/:databaseId/tables/:tableName	team:database:list	read
platform_query_database_table_data	GET /teams/:teamId/databases/:databaseId/tables/:tableName/data	team:database:list	read

Design notes:

• Database reads leak credentials - redact before returning. GET /databases and GET /databases/:databaseId return the DatabaseCredentials view, whose credentials object includes a required password field (forge/ee/db/views/Table.js). These read tools strip the credentials object from the tool output, consistent with the Scoped PATs - Block Broker Credential Issuance for PAT-Authenticated Requests #7513 credential-escalation stance. Table and table-data reads return only schema/row data, no credentials.
• Plan-gated per team (not per user role): tables. When the plan does not include the feature the route returns a 404 independent of the PAT's permissions; the tool surfaces a clear "feature not enabled for this team" message. The response body differs per surface: tables returns the literal Not Found - not available on team.

Scopes to allow-list + access-tag (#7445):
team:database:list (read)