Add MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)

MCP clients use these hints to make safer decisions about which tools require
confirmation or are safe to retry, but none of our 16 built-in tools declared
any. Annotate each based on actual behavior verified against its implementation:
read-only tools get readOnlyHint/idempotentHint true; tools that overwrite or
delete (vault_write, vault_patch, vault_delete, vault_move, command_execute) get
destructiveHint true; additive-only tools (vault_append, open_file) get neither.
openWorldHint is false throughout since every tool operates on the local vault,
not an open-ended external system.

Also extends the public registerTool/addMcpTool API (used by other plugins to
register their own MCP tools via src/api.ts) with an optional annotations
parameter, for parity with the built-in tools. Fully backward-compatible.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>