feat(mcp): search read tools

[andypalmi]

Summary

Adds Phase 1 read-only MCP tools for the search scope (Story 5, #7232).

Tool file: forge/ee/lib/mcp/tools/search.js

Tools added:

• platform_search_team_resources - GET /api/v1/search - search across a team's applications, hosted instances, and remote instances (devices)
• platform_search_instances - GET /api/v1/search/instances - search a team's hosted and remote instances

Both tools are read-only (readOnlyHint: true, destructiveHint: false) and require teamId and query.

Permissions:
#8185 removed the hardcoded user:expert-mcp scope allow-list, so expert MCP tokens now inherit the user's permissions gated by team role and no allow-list entries are needed.

Closes #7677

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.21%. Comparing base (d33b229) to head (7e73cae).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7717      +/-   ##
==========================================
+ Coverage   76.19%   76.21%   +0.01%     
==========================================
  Files         443      444       +1     
  Lines       23726    23737      +11     
  Branches     6314     6314              
==========================================
+ Hits        18079    18090      +11     
  Misses       5647     5647              

Flag	Coverage Δ
backend	76.21% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[andypalmi]

Testing results of new tools

Local platform context these calls ran against:

• One team with hosted instances and one application (no devices), and a second team with 9 hosted instances and 11 remote instances (devices), so both the instance and device match paths could be exercised.

This PR adds 2 read tools to a new search.js; both are exercised below. Payloads show the shape of what came back, with hashids redacted; the object / instanceType discriminators and names are verbatim.

platform_search_team_resources

Searches across a team's applications, hosted instances, and remote instances (devices). Requires teamId and a non-empty query. Each result carries an object discriminator (application | instance | device).

Case	Input params	Verdict	Returned payload (overview, redacted)
matches an instance	{teamId, query:"llm"}	PASS	{count:1, results:[{object:"instance", name:"llm"}]}
matches an application	{teamId, query:"Application"}	PASS	{count:1, results:[{object:"application", name:"Andrea's Application"}]}
matches devices	{teamId, query:"device"}	PASS	{count:3, results:[{object:"device", name}, ...]} (device scope covered on the team with remote instances)
no match	{teamId, query:"zzznomatchxyz"}	PASS	{count:0, results:[]}
empty query	{teamId, query:""}	PASS	{count:0, results:[]} (route returns empty for a blank query; the tool schema also rejects a blank/whitespace query before the call)

platform_search_instances

Searches only the hosted and remote instances of a team. Requires teamId and a non-empty query. Each result carries an instanceType discriminator (hosted | remote).

Case	Input params	Verdict	Returned payload (overview, redacted)
matches hosted instances	{teamId, query:"mcp"}	PASS	{count:2, results:[{instanceType:"hosted", name:"mcp"}, {instanceType:"hosted", name:"mcp-gateway"}]}
matches remote instances	{teamId, query:"device"}	PASS	{count:2, results:[{instanceType:"remote", name}, ...]}
no match	{teamId, query:"zzznomatchxyz"}	PASS	{count:0, results:[]}
empty query	{teamId, query:""}	PASS	{count:0, results:[]}
invalid team	{teamId:"@@bad@@", query:"mcp"}	PASS	{content:{code:bad_request, error:"invalid_team"}, code:400, isError:true}

Conclusion

Both new tools in search.js are verified against their descriptions under team:search: platform_search_team_resources returns typed results across applications, hosted instances, and devices; platform_search_instances returns only hosted and remote instances with an instanceType discriminator. Blank queries return empty results (and are rejected by the tool schema before the call), and an undecodable team id returns a 400. The two endpoints use independent search implementations, so their instance/device result sets can differ for the same query - this is existing route behaviour, unchanged by the tools.