5.9-c Delete and destructive tools (phase 2)

**Parent:** #7678 (5.9 Notifications and user self-service)
**Tool file:** new `forge/ee/lib/mcp/tools/user.js`

`destructiveHint: true`. Kept separate from ordinary writes so MCP clients gate them behind confirmation by default. One tool per delete endpoint.

| Tool | Endpoint | Scope | Annotation |
|---|---|---|---|
| `platform_delete_notification` | `DELETE /user/notifications/:notificationId` | `user:edit` (self) | destructive |

**Design notes:**
- `delete_notification` deletes a single notification by id, self-scoped via `byId(id, request.session.User)` (404 if not owner). There is **no bulk delete-all route**: `DELETE /user/notifications` exists only as commented-out code in `userNotifications.js`, so `notificationId` is required. If a bulk delete is wanted later, the backing route must be built first.

**Tool definitions (description + zod inputSchema):**
```js
platform_delete_notification: {
description: 'Delete a single notification by id. Self-scoped: returns 404 if the notification is not owned by the caller. There is no bulk delete-all option, so notificationId is required.',
inputSchema: z.object({
notificationId: z.string().describe('Notification hashid to delete')
})
}
```

**Excluded (sensitive self-service):** `PUT /user/change_password`, `DELETE /user` (account deletion), `PUT/DELETE /user/mfa*` (MFA), and all `/user/tokens*` routes. Account deletion is destructive and irreversible; token management via a PAT raises the circular-creation concern (#7515). These stay EXCLUDED and are not registered as tools.

**Tests:**
- `delete_notification` carries `destructiveHint: true`; read-only PAT rejected.
- `delete_notification` operates only on the caller's own records (404 for foreign ids).
- Excluded sensitive routes (change_password, account deletion, MFA, tokens) are not registered as tools.

---

Start with forge/ee/lib/mcp/tools/user.js and the existing user notification endpoint implementation, including userNotifications.js. Add the single-notification delete tool with its required notificationId, self-scoped behavior, destructive annotation, and permission handling. Run the MCP tests to verify read-only PAT rejection, foreign-id 404s, and exclusion of the sensitive routes.

Written by the indexing model from the issue text.