Hide mutating tools from read-only tools/list

[Lubrsy706]

Summary

• add an optional listedTools subset to createMcpServer so tools/list can differ from callable tools
• use that subset in Supabase read-only mode to hide write tools from MCP clients while preserving existing runtime read-only errors for stale callers
• add a regression test that verifies read-only tools/list contains no readOnlyHint: false tools

Fixes #281.

Verification

• pnpm --filter @supabase/mcp-utils typecheck
• pnpm --filter @supabase/mcp-utils build
• pnpm --filter @supabase/mcp-server-supabase typecheck
• CI=1 pnpm --filter @supabase/mcp-server-supabase exec vitest run --project unit src/server.test.ts -t "read-only mode excludes write tools from tools/list"
• CI=1 pnpm --filter @supabase/mcp-server-supabase exec vitest run --project unit src/server.test.ts -t "cannot apply migration in read-only mode"
• pnpm exec biome check packages/mcp-utils/src/server.ts packages/mcp-server-supabase/src/server.ts packages/mcp-server-supabase/src/server.test.ts
• pnpm --filter @supabase/mcp-server-supabase build

Note: the full src/server.test.ts suite still hits the existing delete branch failure tracked by #282 / #279 on current main.