5.3-a Read tools (phase 1)

[andypalmi]

Parent: #7672 (5.3 Application management)
Tool file: forge/ee/lib/mcp/tools/applications.js (extend)

Read tools that belong to the application resource. Filed in applications.js alongside the existing application tools, following the one-file-per-resource convention (a tool lives in the file for the noun it is about, regardless of the URL's first path segment).

Tool	Endpoint	Annotation
platform_list_application_snapshots	GET /applications/:applicationId/snapshots	read
platform_get_application_audit_log	GET /applications/:applicationId/audit-log	read
platform_list_team_instance_statuses	GET /teams/:teamId/applications/status	read

The platform_get_application_audit_log tool gains an includeChildren argument to pull in descendant entries within the chosen scope.

Design notes:

• The three per-application instance listers (platform_get_application_hosted_instances, platform_get_application_remote_instances, platform_get_application_instances_status) are not added, because the unified platform_list_hosted_instances and platform_list_remote_instances tools already cover per-application listing via their applicationId argument, and live status via includeLiveStatus on platform_list_hosted_instances.
• platform_list_team_instance_statuses returns the applications in a team with the live status of their instances and devices. It hangs off a team URL but describes application state, so it is filed with the application tools.

Permissions:
#8185 removed the hardcoded user:expert-mcp scope allow-list, so expert MCP tokens now inherit the user's permissions gated by team role and no allow-list entries are needed.

Tests:

• platform_list_application_snapshots injects the snapshots route, serialising cursor and limit onto the query string when given, and returns the response unchanged.
• platform_get_application_audit_log serialises cursor, limit, query, username, scope, an event-name array, and includeChildren onto the query string, injecting the bare route when no filters are set.
• platform_list_team_instance_statuses injects the team application statuses route, serialising associationsLimit onto the query string when given.
• All three tools pass through an error response unchanged.