MCP tools: user mutations (create, update, role assignment)

[The127]

Summary

Add MCP tools for user management mutations.

Depends on #232.

Tools

Tool	API Endpoint	Description
create_user	POST /{vs}/users	Create user (username, displayName, email)
update_user	PATCH /{vs}/users/{id}	Update displayName
set_password	POST /{vs}/users/{id}/set-password	Set/reset password (with optional temporary flag)
assign_role	POST /{vs}/projects/{slug}/roles/{id}/assign	Assign a role to a user
update_user_metadata	PUT /{vs}/users/{id}/metadata/user	Replace global metadata
patch_user_metadata	PATCH /{vs}/users/{id}/metadata/user	Merge-patch global metadata
update_app_metadata	PUT /{vs}/users/{id}/metadata/application/{appId}	Replace per-app metadata

Notes

• All mutations go through the user's RBAC — requires appropriate permissions
• All mutations are audit-logged by Keyline automatically
• set_password requires user:reset_password permission