Mark MCP tools as readonly for M365 federated connector support.

## Title
MCP tools missing `annotations` (readOnlyHint/destructiveHint) required by MCP spec and consumers like M365 Copilot Federated Connectors

## Summary
DAB's built-in MCP DML tools (`describe_entities`, `read_records`, `aggregate_records`, and presumably `create_record`/`update_record`/`delete_record`) do not emit an `annotations` object in their `tools/list` response. This blocks integration with MCP consumers that require tool annotations for safety validation — specifically, Microsoft 365 Copilot's federated connector, which rejects or silently drops tools lacking `readOnlyHint`.

## Current behavior
`tools/list` response for built-in tools has no `annotations` field, e.g.:

```json
{
"name": "read_records",
"description": "...",
"inputSchema": { ... }
}
```
## Expected behavior

Each tool should include an annotations object per the MCP spec, e.g.:

```json
{
"name": "read_records",
"description": "...",
"inputSchema": { ... },
"annotations": {
"readOnlyHint": true
}
}
```
At minimum, describe_entities, read_records, and aggregate_records should be marked readOnlyHint: true. Any write tools (create_record, update_record, delete_record) should be marked readOnlyHint: false and destructiveHint set appropriately (true for delete/update, false for create).

## Impact

Without this, DAB's MCP server cannot be registered as a custom connector in Microsoft 365 Copilot (and likely other MCP consumers enforcing the same validation), since these platforms require explicit read-only annotations before allowing a tool to be surfaced/executed.

## Environment
DAB version: 2.x (MCP support)
Consumer: Microsoft 365 Copilot federated connector (custom MCP connector)

Beginne mit der tools/list-Antwort des MCP-Servers und finde die integrierten DML-Tooldefinitionen für describe_entities, read_records, aggregate_records, create_record, update_record und delete_record. Vergleiche deren Ausgabe mit den MCP-Anforder​​ungen für Annotationen und überprüfe anschließend, dass schreibgeschützte und schreibende Tools die erwarteten Werte für readOnlyHint und destructiveHint bereitstellen.

Vom Indexierungsmodell aus dem Issue-Text verfasst.