refactor: split tools.ts into registry-based domain files

Replaces the single 800-line tools.ts and its switch dispatcher with a
Theia-inspired registry pattern — each tool domain is its own file, and
dispatch is a plain Map.get() call with no central routing function.

New structure in src/tools/:
  registry.ts   — ToolDefinition (with handler), registerTool(), executeTool(), ALL_TOOLS
  context.ts    — ToolContext, MemoryUpdate interfaces
  security.ts   — PROTECTED_* constants + assertGiteaWritable/assertCoolifyDeployable
  utils.ts      — safeResolve(), EXCLUDED set
  file.ts       — read_file, write_file, replace_in_file, list_directory, find_files, search_code
  shell.ts      — execute_command
  git.ts        — git_commit_and_push
  coolify.ts    — coolify_*, list_all_apps, get_app_status, deploy_app
  gitea.ts      — gitea_*, list_repos, list_all_issues, read_repo_file
  agent.ts      — spawn_agent, get_job_status
  memory.ts     — save_memory
  index.ts      — barrel with side-effect imports + re-exports

Adding a new tool now requires only a new file + registerTool() call.
No switch statement, no shared array to edit. External API unchanged.

Made-with: Cursor

dist/tools/security.d.ts

@@ -0,0 +1,11 @@
+/** Gitea repos agents can NEVER push to, commit to, or write issues on. */
+export declare const PROTECTED_GITEA_REPOS: Set<string>;
+/** Coolify project UUID for the VIBN platform — agents cannot deploy here. */
+export declare const PROTECTED_COOLIFY_PROJECT = "f4owwggokksgw0ogo0844os0";
+/**
+ * Specific Coolify app UUIDs that must never be deployed by an agent.
+ * Belt-and-suspenders check in case the project UUID filter is bypassed.
+ */
+export declare const PROTECTED_COOLIFY_APPS: Set<string>;
+export declare function assertGiteaWritable(repo: string): void;
+export declare function assertCoolifyDeployable(appUuid: string): void;