feat(mcp): device group read tools

[andypalmi]

Summary

Add Phase 1 read-only MCP tools for fleet device groups, per #7699.

Tools added (forge/ee/lib/mcp/tools/deviceGroups.js):

• platform_list_team_device_groups - lists the device groups across all applications in a team. GET /api/v1/teams/:teamId/device-groups
• platform_list_application_device_groups - lists the device groups belonging to a single application. GET /api/v1/applications/:applicationId/device-groups
• platform_get_application_device_group - GET /api/v1/applications/:applicationId/device-groups/:groupId

All routes require the deviceGroups team feature; when disabled they return the existing 404 gate response.

Write, membership, settings, and delete tools are tracked separately in sub-issues #7700 and #7701 and are not part of this PR.

Permissions:
#8185 removed the hardcoded user:expert-mcp scope allow-list, so expert MCP tokens now inherit the user's permissions gated by team role and no allow-list entries are needed.

Closes #7699

Test plan

• eslint on changed files
• mocha unit tests for the tool file

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.96%. Comparing base (d3419bb) to head (cc70506).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7719      +/-   ##
==========================================
+ Coverage   75.94%   75.96%   +0.01%     
==========================================
  Files         445      446       +1     
  Lines       23990    24004      +14     
  Branches     6404     6404              
==========================================
+ Hits        18220    18234      +14     
  Misses       5770     5770              

Flag	Coverage Δ
backend	75.96% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[andypalmi]

Testing results of new/changed tools

@cstns for visibility.

The three tools in this PR were invoked against a running local platform. The context the calls ran against:

• A team with the deviceGroups team-type feature enabled, and a sibling team without it.
• An application in that team with one device group, fully configured: a target snapshot, two member devices, and a settings block with one visible and one hidden environment variable.

Payloads below are redacted for ids, names and secrets; structural values (counts, statuses, and which fields are present) are verbatim.

platform_list_team_device_groups

Lists the device groups across all applications in a team.

Case	Input params	Verdict	Returned payload (redacted)
team with one group	{teamId: TEAM_ID, limit: 10}	PASS	{meta:{}, count:1, groups:[{id, name, description, deviceCount:2, targetSnapshot:{id,name,description,createdAt}, application:{id,name,description,links}}]}
unknown team	{teamId:"doesnotexist", limit:10}	PASS	404 isError, {code:"not_found"}
team without the deviceGroups feature	{teamId: TEAM_ID_2, limit:10}	PASS	404 isError, {code:"not_found"} - matches the tool's documented behaviour for a disabled feature

platform_list_application_device_groups

Lists the device groups belonging to a single application.

Case	Input params	Verdict	Returned payload (redacted)
application with one group	{applicationId: APP_ID, limit:10}	PASS	{meta:{}, count:1, groups:[{id, name, description, deviceCount:2, targetSnapshot:{...}}]}
query matching the group name	{applicationId: APP_ID, limit:10, query:"harness"}	PASS	same single group returned
query matching nothing	{applicationId: APP_ID, limit:10, query:"zzz-nomatch"}	PASS	{meta:{}, count:1, groups:[]} - matches the raw route byte-for-byte; the route's own count does not reflect the query filter, which is a pre-existing characteristic of the underlying endpoint, not something the tool introduces

platform_get_application_device_group

Fetches a single device group in an application, including its members and target snapshot.

Case	Input params	Verdict	Returned payload (redacted)
existing group, fully configured	{applicationId: APP_ID, groupId: GROUP_ID}	PASS	full detail including 2 devices (each with id, status, onlineStatus, mode, ownerType, name, type, activeSnapshot, targetSnapshot, links), settings.env with the hidden variable's value blanked, targetSnapshot, application
unknown group	{applicationId: APP_ID, groupId:"doesnotexist"}	PASS	404 isError, {code:"not_found"}

Findings

• All three tools pass the route response through unchanged: each tool's output matched its corresponding raw REST route response byte-for-byte for the same parameters.
• platform_get_application_device_group correctly surfaces the hidden environment variable's name and hidden flag while blanking its value, matching the underlying route's masking behaviour.
• A team with the deviceGroups feature disabled returns a 404 from platform_list_team_device_groups, matching the tool's documented plan-gating behaviour.

Conclusion

All three tools verified against their descriptions, including feature-gating and the environment variable secret-masking guarantee. No open defects.