Custom HTTP tools an administrator defines

A row in custom_tools becomes a ToolDef like any built-in, offered beside
the thirteen. The registry had to stop being an import-time constant for
that: `resolve_tools` now returns the schemas *and* the runners together,
carried to the loop on the ToolContext.

That closes a hole on the way. `run_tool` looked names up in the global
REGISTRY with no reference to what had been offered, so a model naming a
tool its chat was gated out of -- a family switched off, a permission the
reader lacks -- had it run anyway. The resolved set is now authoritative.

Arguments come from a model, so an argument may fill a hole but never move
the target: the scheme and host of a URL template are literal, values are
escaped for where they land, and the origin is pinned afterwards. Every
redirect hop is checked the way services/fetch.py checks one, and the
secret is dropped if a hop leaves the origin it was issued for.

Also fixes the tool-activity block claiming every library tool had
"searched the web", which it has done since the second family landed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/api/admin_models.py

@@ -24,15 +24,23 @@ router = APIRouter(tags=["admin-models"])
 # these are an administrator's assertion.
 PROTOCOL_CAPABILITIES = ("reasoning", "vision", "tools")
 
-# Which built-in tools this model is given. Distinct from the above: `tools` is
-# whether a tools array may be sent at all, these are what goes in it. Every one
-# of them is meaningless unless `tools` is on.
+# Which tools this model is given. Distinct from the above: `tools` is whether a
+# tools array may be sent at all, these are what goes in it. Every one of them is
+# meaningless unless `tools` is on.
+#
+# The last two are gates rather than single tools: one covers every custom HTTP
+# tool an administrator has defined, the other every MCP server. Which of those
+# a particular person gets is the tool's own group list, not a flag here -- a
+# server can advertise forty tools, and a model page listing all of them is a
+# page nobody can read.
 TOOL_CAPABILITIES = (
     ("tool_web_search", "Web search"),
     ("tool_knowledge", "Knowledge"),
     ("tool_notes", "Notes"),
     ("tool_memory", "Memory"),
     ("tool_skills", "Skills"),
+    ("tool_custom", "Custom tools"),
+    ("tool_mcp", "MCP servers"),
 )
 
 CAPABILITIES = PROTOCOL_CAPABILITIES + tuple(key for key, _ in TOOL_CAPABILITIES)