fix(mcp): tools outside the baseline families ask for their own scope - #2564

🟢 Confidence 8/10 · likely safe to merge. Refusal path is pinned for all 24 tools, but nothing ties the demanded families to the grantable ones in Settings, where this branch already drifted once.
_{no findings · tests partial −1 · risk high −1}

The change gives 24 MCP tools their own scope families, lets scopeFamily list several, and exposes six families in Settings. The McpQueryError issues in registry.ts are query failures this diff does not touch.

• 24 MCP tools now declare a scope family outside the baseline set
• scopeFamily accepts a list; get_status_page requires both status-page families
• Six new families added to the key dialog and scope reference

Before merge

• Manual · Restricted keys calling these 24 tools today get insufficient_scope after the deploy until the new scopes are added to them.

Production impact

_{a98700f · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}