fix(cluster): honor read-only active task fallbacks

[FreeOnePlus]

Summary

• align doris_cluster.list_active_tasks capability detection with the runtime's existing read-only fallback chain
• expose the child when either the active-query view or process list is readable even if SHOW PROC \"/current_queries\" is denied
• narrow the public task_types schema and description to the query and compaction task types actually implemented

Root cause

The capability detector checked only SHOW PROC \"/current_queries\", while the execution runtime already fell back to information_schema.active_queries and SHOW FULL PROCESSLIST. Restricted Doris accounts could therefore execute a safe fallback but never discover or call the child because availability was rejected first.

User impact

Read-only enterprise identities can now use active-query inspection without receiving broader administrative privileges. Load and schema-change status remain in the pipeline domain instead of being overstated by the cluster task contract.

Validation

• uv lock --check
• uv run --frozen python generate_tool_catalog.py --check
• uv run --frozen ruff check .
• uv run --frozen mypy doris_mcp_server
• uv run --frozen bandit -q -c pyproject.toml -r doris_mcp_server doris_mcp_client generate_requirements.py generate_tool_catalog.py
• uv run --frozen pytest -q -W error (1827 passed, 85 skipped, coverage 67.98%)

The real Doris 4.0.5 restricted-reader case that exposed this mismatch will be repeated against the exact committed candidate before downstream acceptance.