5.4-a.3 Shared library PAT access

**Parent:** #7673 (5.4 Teams and membership)
**Related:** #7693, where a `platform_list_library_entries` tool was originally scoped and then pulled out pending this fix.

The shared library storage API (`forge/ee/routes/sharedLibrary/index.js`, mounted at `/storage/library/:libraryId/*`) currently only accepts three kinds of caller in its top-level access check:

- cookie sessions (`!request.session.ownerType`)
- project tokens (`request.session.ownerType === 'project'`)
- device tokens (`request.session.ownerType === 'device'`)

A personal access token has `ownerType === 'user'`, which matches none of those branches, so the shared preHandler returns a plain 404 before the route's own `needsPermission` check is ever reached. This blocks every PAT-authenticated caller, not just a specific one: a 3rd-party integration using a scoped user PAT and the 1st-party platform-automation caller (`user:expert-mcp` PAT) are both refused today.

**Goal:** make the shared library accessible to PAT-authenticated callers, for both:
- 3rd-party callers using a regular user PAT, gated by the caller's own team role/permissions (`library:entry:list` etc.), same as any other team-scoped resource.
- 1st-party platform-automation callers (`user:expert-mcp` ownerType).

**Open questions to resolve in the design:**
- Whether to allow the plain `user` ownerType through the shared preHandler alongside `user:expert-mcp` (broadest fix, matches how other team-scoped routes treat PATs), or something narrower.
- Whether `team:read`-equivalent permission is sufficient for listing, or the existing `library:entry:list`/`library:entry:create`/`library:entry:delete` permissions already cover this correctly once the caller can reach them.

Once this lands, add back a `platform_list_library_entries` read tool (`GET /storage/library/:libraryId/*`) in `forge/ee/lib/mcp/tools/teams.js`.

Start in forge/ee/routes/sharedLibrary/index.js, tracing the shared preHandler and its existing needsPermission checks for /storage/library/:libraryId/*. Resolve how user and user:expert-mcp PAT callers should pass the top-level check without bypassing team permissions. Then restore platform_list_library_entries in forge/ee/lib/mcp/tools/teams.js and verify that listing works for permitted PAT callers while unauthorized callers remain blocked.

Written by the indexing model from the issue text.