Custom HTTP tools an administrator defines

A row in custom_tools becomes a ToolDef like any built-in, offered beside
the thirteen. The registry had to stop being an import-time constant for
that: `resolve_tools` now returns the schemas *and* the runners together,
carried to the loop on the ToolContext.

That closes a hole on the way. `run_tool` looked names up in the global
REGISTRY with no reference to what had been offered, so a model naming a
tool its chat was gated out of -- a family switched off, a permission the
reader lacks -- had it run anyway. The resolved set is now authoritative.

Arguments come from a model, so an argument may fill a hole but never move
the target: the scheme and host of a URL template are literal, values are
escaped for where they land, and the origin is pinned afterwards. Every
redirect hop is checked the way services/fetch.py checks one, and the
secret is dropped if a hop leaves the origin it was issued for.

Also fixes the tool-activity block claiming every library tool had
"searched the web", which it has done since the second family landed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/db/models/__init__.py

@@ -42,6 +42,21 @@ from lembas.db.models.library import (
 )
 from lembas.db.models.setting import Setting
 from lembas.db.models.suggestion import Suggestion
+from lembas.db.models.tool import (
+    RESPONSE_JSON,
+    RESPONSE_MODES,
+    RESPONSE_RAW,
+    RESPONSE_TEXT,
+    SECRET_BEARER,
+    SECRET_HEADER,
+    SECRET_NONE,
+    SECRET_PLACEMENTS,
+    SECRET_QUERY,
+    CustomTool,
+    McpServer,
+    custom_tool_groups,
+    mcp_server_groups,
+)
 from lembas.db.models.user import (
     ROLE_ADMIN,
     ROLE_PENDING,
@@ -63,20 +78,31 @@ __all__ = [
     "RESOURCE_BASE",
     "RESOURCE_NOTE",
     "RESOURCE_SKILL",
+    "RESPONSE_JSON",
+    "RESPONSE_MODES",
+    "RESPONSE_RAW",
+    "RESPONSE_TEXT",
     "ROLE_ADMIN",
     "ROLE_ASSISTANT",
     "ROLE_PENDING",
     "ROLE_SYSTEM",
     "ROLE_TOOL",
     "ROLE_USER",
+    "SECRET_BEARER",
+    "SECRET_HEADER",
+    "SECRET_NONE",
+    "SECRET_PLACEMENTS",
+    "SECRET_QUERY",
     "SOURCE_LINK",
     "SOURCE_UPLOAD",
     "Chat",
     "Connection",
+    "CustomTool",
     "Document",
     "Folder",
     "Group",
     "KnowledgeBase",
+    "McpServer",
     "Memory",
     "Message",
     "Model",
@@ -89,6 +115,8 @@ __all__ = [
     "Suggestion",
     "User",
     "chat_knowledge_bases",
+    "custom_tool_groups",
+    "mcp_server_groups",
     "model_groups",
     "user_groups",
 ]