…_action

Wave FIX-E findings. The MCP shipped four tools wired to /api/me/*
paths that the router never registered — every call returned a generic
"instanode.dev error (404)" and the LLM had no path forward. This PR
rewires those tools to the canonical routes, plus three smaller
contract drifts:

* /api/me/resources           → GET    /api/v1/resources           (list)
* /api/me/claim               → POST   /claim   (now takes jwt + email)
* /api/me/resources/{token}   → DELETE /api/v1/resources/{token}
* /api/me/token               → POST   /api/v1/auth/api-keys       (mint)

  The list endpoint returns {ok, items, total}; client now unwraps to
  items[] so the tool can iterate naturally. The claim flow primitive
  is identity-bound — there is no "claim a token to an existing team"
  route — so claim_token's schema is now (upgrade_jwt, email), matching
  the dashboard's flow. The mint route returns a plaintext key that's
  shown exactly once; get_api_token's wording was updated to reflect
  revocation-based (not time-bound) keys. #C5

* claim_resource built https://instanode.dev/start?t=<jwt>. /start is a
  route on the API host, NOT the dashboard host — the dashboard
  domain's path is /claim. /start is what issues the 302 to /claim.
  Now builds api.instanode.dev/start?t=<jwt>; configurable via
  INSTANODE_API_URL same as every other request. #C6

* MCP discarded `agent_action` from API error envelopes. The API
  copy-edits these sentences specifically for the LLM to read aloud
  ("Tell the user they've hit the hobby tier storage limit — have them
  upgrade at https://instanode.dev/pricing"). formatError now appends
  Action + Upgrade + Claim lines below the headline so the user gets
  the platform's canonical CTA instead of a generic "API error 402".
  client.ApiError carries the new agentAction + claimURL fields. #C7

* server.json + smithery.yaml declared INSTANODE_API_BASE while
  client.ts always read INSTANODE_API_URL. The registry-side name
  never took effect — users who set it via Smithery silently got the
  default base URL. Standardized on INSTANODE_API_URL (the name the
  client honors today). #C8

* Bumped 0.9.0 → 0.9.1. The previous 0.9.0 npm publish failed and
  `npx instanode-mcp@latest` 404'd; this version closes both. The npm
  publish step is documented in PUBLISHING.md and must be run manually
  (no NPM_TOKEN was available in the env where this PR was produced).
  #C4 #C106

test.sh extended: two new gates assert the claim host is the API host
and that claim_token rejects the old (token-only) shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>