feat(private-server): expose incidents and issues over MCP

[passcod]

🤖 Extends the read-only MCP query interface to cover incidents and issues, so an agent can answer questions like "summarise all incidents that were open in the past week".

New tools

• find_incidents — incidents that were open at any point in a look-back window (default 7 days), optionally for one group, each with status (open/closed/resolved), opened/closed/resolved timing, who resolved it and why, whether it escalated, and issue/event counts. A status filter narrows to open or resolved.
• get_incident — one incident plus the issues attached to it (severity, source, ref, message, owning server, active state, join/leave times).
• find_issues — issues across the fleet, filtered by active state, severity, group, server, and recency.
• get_issue — one issue plus its recent events and the incidents it is or was part of.

Notes

• New DB query Incident::list_open_since implements "open at any point in the window" (still open, or closed no earlier than the window start) — not just "opened within it".
• Added an optional since filter to IssueListFilters/Issue::list for issue recency; the existing handler is unchanged behaviourally (passes None).
• Backup/incident health classifications continue to reuse the existing definitions; no new query semantics invented.
• Not added to openapi.json — MCP self-describes via tools/list, and no REST handler signatures changed.

Spec updated in .workhorse/specs/private-server/mcp.md.