5.6-c Delete and destructive tools (phase 2)

**Parent:** #7675 (5.6 Device groups (fleet))
**Tool file:** new `forge/ee/lib/mcp/tools/deviceGroups.js`

`destructiveHint: true`. Kept separate from ordinary writes so MCP clients gate them behind confirmation by default. One tool per endpoint; no consolidation.

| Tool | Endpoint | Scope | Annotation |
|---|---|---|---|
| `platform_delete_device_group` | `DELETE /applications/:applicationId/device-groups/:groupId` | `application:device-group:delete` | destructive |

**Design notes:**
- Requires the `deviceGroups` feature (404 otherwise); surface as the descriptive "device groups not enabled for this team" error.

**Tool definitions (description + zod inputSchema):**
```js
platform_delete_device_group: {
description: 'Delete a device group from an application.',
inputSchema: z.object({
applicationId: z.string().describe('Application hashid the group belongs to'),
groupId: z.string().describe('Device group hashid to delete')
})
}
```

**Tests:**
- The tool carries `destructiveHint: true`.
- Read-only PAT is rejected.

---

Start with the new forge/ee/lib/mcp/tools/deviceGroups.js file and compare its definitions with the device-groups API endpoint described in the issue. Confirm the tool schema, destructiveHint annotation, feature-disabled error, and read-only PAT rejection; done means the delete endpoint is exposed with the listed tests passing.

Written by the indexing model from the issue text.