Custom HTTP tools an administrator defines

A row in custom_tools becomes a ToolDef like any built-in, offered beside
the thirteen. The registry had to stop being an import-time constant for
that: `resolve_tools` now returns the schemas *and* the runners together,
carried to the loop on the ToolContext.

That closes a hole on the way. `run_tool` looked names up in the global
REGISTRY with no reference to what had been offered, so a model naming a
tool its chat was gated out of -- a family switched off, a permission the
reader lacks -- had it run anyway. The resolved set is now authoritative.

Arguments come from a model, so an argument may fill a hole but never move
the target: the scheme and host of a URL template are literal, values are
escaped for where they land, and the origin is pinned afterwards. Every
redirect hop is checked the way services/fetch.py checks one, and the
secret is dropped if a hop leaves the origin it was issued for.

Also fixes the tool-activity block claiming every library tool had
"searched the web", which it has done since the second family landed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/db/models/user.py

@@ -14,6 +14,7 @@ from lembas.db.types import JSONDict
 if TYPE_CHECKING:
     # Annotation only; SQLAlchemy resolves the real class from its registry.
     from lembas.db.models.connection import Model
+    from lembas.db.models.tool import CustomTool, McpServer
 
 # Roles are a simple ordered ladder rather than a permission matrix. Groups
 # (below) carry finer-grained permissions once the users/groups UI lands.
@@ -72,6 +73,12 @@ class Group(UUIDPrimaryKey, Timestamps, Base):
     models: Mapped[list[Model]] = relationship(
         "Model", secondary="model_groups", back_populates="groups"
     )
+    custom_tools: Mapped[list[CustomTool]] = relationship(
+        "CustomTool", secondary="custom_tool_groups", back_populates="groups"
+    )
+    mcp_servers: Mapped[list[McpServer]] = relationship(
+        "McpServer", secondary="mcp_server_groups", back_populates="groups"
+    )
 
 
 class Session(UUIDPrimaryKey, Timestamps, Base):