Stage 2/3: Wrap shared tool core as a Python MCP server

[JoshuaVSherman]

Part of #73 (see it for full inventory, architecture, and rationale). Depends on Stage 1 (the extracted core).

Stage 2 of 3 — Wrap the shared core as an MCP server

Expose the extracted webjam-tools-core (17 tools + guards + auth) as a Python MCP server so any MCP client (agy/Flash, Claude Code) can call the tools. Single source of truth, no duplication.

The change

• Add an MCP server entry point over the core. The Tool descriptor already carries name / description / parameters (JSON schema) / handler, which maps almost 1:1 onto MCP tool definitions — generate the MCP tool list from the existing registrations rather than redefining schemas.
• Preserve guards.py enforcement (protected-file checks, filename discipline) and the gmail "draft, never auto-send" behavior on the server side.
• Credentials: reuse the existing google-drive-mcp + gmail-mcp OAuth tokens via auth.py; confirm the server can load them in its runtime. (Reuse the Deploy daily-devotional generator to a scheduled cloud runtime (laptop-independent) #69 secret-store pattern only if the server is ever run off-laptop.)

Acceptance criteria

• MCP server lists all 17 tools with correct schemas.
• Each tool is callable through the MCP server and returns the same result as the in-process gemma-cli call.
• Guard-rails enforced server-side (protected-file write blocked without force; gmail drafts not sent).
• No tool logic duplicated — server is a thin adapter over the core.
• remember_fact target decided when invoked outside gemma (GEMMA.md vs model-neutral memory file).

PR closing keyword: Closes #<this issue> only. Parent epic #73 closes with Stage 3.