feat(mcp): add tool visibility presets (#786)

[joshrotenberg]

Summary

• Add [tools] section to mcp-policy.toml with preset, include, and exclude fields for per-tool visibility control
• Ship curated "essentials" preset (~61 tools: 20 cloud, 18 enterprise, 15 database, 8 app) to keep MCP clients under the ~50-100 tool degradation threshold
• Add list_available_tools system tool so LLMs can discover hidden tools and request specific ones via the include list
• Combine visibility + policy in a single CapabilityFilter closure; system tools (show_policy, list_available_tools) bypass visibility
• Backward compatible: no [tools] section = preset = "all" (current behavior, all tools loaded)

Configuration example

[tools]
preset = "essentials"
include = ["enterprise_raw_api", "get_enterprise_crdb"]
exclude = ["flush_database"]

Resolution: preset base -> +include -> -exclude -> policy tier/deny/allow

Files changed

File	Change
presets.rs (new)	ToolsConfig, essentials constants, resolve_visible_tools(), ToolVisibility, list_available_tools_tool(), cross-validation tests
policy.rs	tools: ToolsConfig field on PolicyConfig, TOML parsing tests
lib.rs	pub mod presets;
main.rs	Wire visibility into build_router, combined filter, instructions prefix, tests

Test plan

• cargo check -p redisctl-mcp --all-features
• cargo check -p redisctl-mcp --no-default-features
• cargo check -p redisctl-mcp --features cloud
• cargo check -p redisctl-mcp --features enterprise
• cargo check -p redisctl-mcp --features database
• cargo clippy -p redisctl-mcp --all-features -- -D warnings
• cargo fmt --all -- --check
• cargo test -p redisctl-mcp --all-features
• Cross-validation tests: each essentials constant validated against its toolset's TOOL_NAMES

Closes #786