feat(vault): add secret copy and service token tools to @ferrvault/api-mcp

[BryanFRD]

Adds four tools to @ferrvault/api-mcp.

• copy_ferrvault_secret: source {vault, environment, name}, target {vault, environment, name?} (name defaults to the source name). Reveals the source and creates or versions the target inside the server. The value is never returned and is redacted from errors. Refuses a target equal to the source. Returns outcome (created/versioned), target coordinates, source_version, target_version.
• list_ferrvault_service_tokens: GET /vaults/{vault}/environments/{env}/operator/tokens. Whitelisted metadata only (id, name, vault, environment, role, created_by, created_at, expires_at, last_used_at); token_preview is dropped too.
• create_ferrvault_service_token: POST .../operator/tokens with {label, role, expires_at?}, then writes the returned token into store {vault, environment, name} with the same create-or-version logic. The token is never returned and is redacted from errors. If the write fails, the new token is revoked (DELETE .../operator/tokens/{id}) and the error says whether that worked.
• revoke_ferrvault_service_token: DELETE .../operator/tokens/{id}, id validated as a uuid.

Tokens are bound to one vault environment (that is how the API scopes them), and all three token routes require the admin role on the vault.

The create-or-version logic moved to upsert.ts so the new tools share it. set_ferrvault_secret and generate_ferrvault_secret still report rotated. guarded can now redact values that are only known mid-call (the revealed value, the created token). The test harness moved to __tests__/harness.ts and also exposes the registered input schemas, so the tests check path parameter validation against the real tool schemas, nested objects included.

[ferrfleet]

Nothing blocking. The secret-handling paths look right: copied values and new tokens are redacted from errors through redactLater, a failed store revokes the new token, and the upsertSecret extraction keeps set/generate behaving as before.

• Nit: there are now two names for the same outcome. set/generate report rotated (secret-writes.ts:12), while copy and create_ferrvault_service_token report versioned through versionOutcome. Pick one word for the public output. If rotated has to stay for compatibility, have versionOutcome take the label so the mapping isn't written twice.
• Nit: the gitleaks alert on service-tokens.test.ts:15 is a fake fixture UUID. Dismiss it as a test value so it doesn't sit on the PR.

[BryanFRD]

Folded the outcome mapping into one outcome(upserted, label) helper in upsert.ts, used by all four write tools. set/generate keep rotated so their output stays compatible. Renamed the uuid fixture so gitleaks stops matching on the variable name.

[ferrfleet]

8761b69 handles the outcome-label nit: set/generate and copy/create_ferrvault_service_token now share one mapping through outcome(written, label), and the public output is the same as before. Nothing new is broken.