Feat: ship 38 new tools (waves 1-6) + full Pydantic input validation

Tool surface: 31 -> 69 across 11 categories. Every public tool now
ships with a strict extra='forbid' Pydantic request model.

New tools by wave:
- Wave 1 (10): list_purchase_orders, list_vendors, list_items, get_item,
  list_storerooms, list_service_requests, get_service_request,
  list_job_plans, get_my_assigned_workorders, get_workorder_tasks
- Wave 2 (5 + 3 re-enables): get_failure_class_hierarchy, get_meter_readings,
  get_asset_criticality_matrix, get_failure_pareto, get_bad_actor_assets,
  + re-enabled detect_asset_anomalies, suggest_root_cause, summarize_asset_health
- Wave 3 (6): get_job_plan, get_workorder_actuals_vs_planned,
  get_schedule_calendar, estimate_workorder_cost, list_crafts,
  find_available_technician
- Wave 4 (6): list_purchase_requisitions, get_spend_analysis,
  get_workorder_costs, get_inventory_valuation, get_critical_spares_check,
  get_warranty_status
- Wave 5 (6): list_calibration_due, list_inspections_due, list_permits_to_work,
  list_certifications_expiring, list_incidents, get_compliance_dashboard
- Wave 6 (2 re-enables): export_workorders_excel, export_asset_report_pdf

Quality gates:
- 270 unit tests pass (260 pre-existing + 10 new in test_tool_models.py)
- 5 live-server integration smoke tests under tests/integration/
- ruff clean across all new code
- Pydantic models: 8 -> 49 (extra='forbid' everywhere)
- Drift detector test caught + fixed 1 real bug (search_assets server
  wrapper was dropping page_num)

Maximo build quirks documented + handled:
- OSLC orderBy requires +/- direction prefix on strict-OSLC builds
- Compound WHERE drops connection (refactored 3 AI tools to single-cond)
- Sparse-NULL columns get stripped when used as orderBy (sort in Python)
- Maximo dates carry tz, user inputs don't (replace tzinfo before compare)
- Multi-candidate OS fallback (mx* -> mxapi*) for build-version coverage
- Graceful data_unavailable=True when an OS isn't published