fix(mcp): use FORBIDDEN for read-only upsert rejection (RAAE-1607)

Align the read-only write rejection with the FORBIDDEN error code used on the
1604 branch, instead of INVALID_REQUEST. A read-only binding is a permission
policy denial (the request is well-formed but not allowed), so FORBIDDEN is the
correct category; INVALID_REQUEST remains for malformed/unroutable requests
(unknown index, omitted index, bad shapes). Keeps the two stacked branches
consistent so they reconcile cleanly when the stack is collected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: vishal-bala

redisvl/mcp/tools/upsert.py

@@ -266,7 +266,7 @@ async def upsert_records(
         if rt.effective_read_only:
             raise RedisVLMCPError(
                 f"index '{rt.binding_id}' is read-only",
-                code=MCPErrorCode.INVALID_REQUEST,
+                code=MCPErrorCode.FORBIDDEN,
                 retryable=False,
             )
         index_obj = rt.index

tests/integration/test_mcp/test_upsert_tool.py

@@ -466,7 +466,7 @@ async def test_upsert_records_rejects_writes_to_read_only_binding(
             records=[{"content": "doc", "category": "operations"}],
         )
 
-    assert exc_info.value.code == MCPErrorCode.INVALID_REQUEST
+    assert exc_info.value.code == MCPErrorCode.FORBIDDEN
 
 
 @pytest.mark.asyncio

tests/unit/test_mcp/test_upsert_tool_unit.py

@@ -509,7 +509,7 @@ async def test_upsert_records_rejects_writes_to_read_only_binding():
     with pytest.raises(RedisVLMCPError, match="read-only") as exc_info:
         await upsert_records(server, records=[{"content": "alpha doc"}])
 
-    assert exc_info.value.code == MCPErrorCode.INVALID_REQUEST
+    assert exc_info.value.code == MCPErrorCode.FORBIDDEN
     # Write policy is enforced before any embedding or backend write.
     assert server.index.load_calls == []
     assert server.vectorizer.aembed_many_calls == []