feat: advertise every tool as read-only via registerTool annotations

Migrate all 13 tools from the deprecated positional `server.tool()` to
`registerTool()`, and declare `annotations: { readOnlyHint: true }` on each.

The README's first blast-radius claim is that this server is read-only by
construction, but that guarantee was prose only — nothing in `tools/list` said
so, and a host had no way to see it. The annotation makes it machine-readable.
It is truthful for `shopify_graphql` too: `assertReadOnly` rejects mutation and
subscription operations before any network call.

Also extract `toFailure()` out of `wrap()` so error rendering is reusable, and
let a plain Error carry structured `details` through instead of flattening to
its message.

`test/tools.test.ts` now reads the tool list off a real MCP client rather than
spying on the registration call, so it asserts what a host actually receives —
including that no tool is missing the annotation. Verified it bites: flipping
one tool to `readOnlyHint: false` fails with the offending tool named.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>