5.6-a Read tools (phase 1)

[andypalmi]

Parent: #7675 (5.6 Device groups (fleet))
Tool file: new forge/ee/lib/mcp/tools/deviceGroups.js

readOnlyHint: true.

Tool	Endpoint	Annotation
platform_list_team_device_groups	GET /teams/:teamId/device-groups	read
platform_list_application_device_groups	GET /applications/:applicationId/device-groups	read
platform_get_application_device_group	GET /applications/:applicationId/device-groups/:groupId	read

Design notes:

• The team and application listings are filed as two separate tools rather than one tool switched by which id is passed, following the one-tool-per-endpoint convention used elsewhere in the read-tool set.
• All routes require the deviceGroups feature (404 otherwise). Surface as a descriptive "device groups not enabled for this team" error.
• Team-group list filters applications per project:read RBAC for non-admins; a scoped PAT sees a subset, not an error.

Permissions:
#8185 removed the hardcoded user:expert-mcp scope allow-list, so expert MCP tokens now inherit the user's permissions gated by team role and no allow-list entries are needed.

Tests:

• Read tools allowed for read-only PAT.
• Feature-disabled team returns the descriptive gate error.
• Team-scoped PAT sees only in-scope applications' groups.

---