feat(auth): split inventory scope out of server scope

Carve a new nezha:inventory:{read,delete,*} resource family out of
nezha:server:*. Listing and deleting servers/server-groups (GET /server,
/server-group, /ws/server, batch-delete/server[-group], MCP server.list)
now require nezha:inventory:*, while nezha:server:* covers per-server
runtime operations (get, exec, fs, config, metrics, batch-move,
force-update).

Also declare MCP tool OutputSchema for exec/fs/meta/server/transfer and
wrap server.list output in {servers,count} so strict MCP clients accept
the structured result. Correct the /file all-of scope entry and the stale
server:read documentation.

cmd/dashboard/controller/api_token_optional_scope_test.go

@@ -24,7 +24,7 @@ func setupOptionalAuthRouter(t *testing.T, plainToken string) *httptest.Server {
 
 	stub := func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) }
 	optionalAuth := r.Group("/api/v1", authMw)
-	optionalAuth.GET("/server-group", restScopeMiddleware(model.ScopeServerRead), stub)
+	optionalAuth.GET("/server-group", restScopeMiddleware(model.ScopeInventoryRead), stub)
 	optionalAuth.GET("/service", restScopeMiddleware(model.ScopeServiceRead), stub)
 	optionalAuth.GET("/server/:id/metrics", restScopeMiddleware(model.ScopeServerRead), stub)
 
@@ -56,7 +56,7 @@ func TestOptionalAuth_PATWithMatchingScopeAllowed(t *testing.T) {
 	cleanup, uid := setupMCPTest(t)
 	defer cleanup()
 
-	_, plain := mkToken(t, uid, []string{model.ScopeServerRead, model.ScopeServiceRead}, nil)
+	_, plain := mkToken(t, uid, []string{model.ScopeInventoryRead, model.ScopeServerRead, model.ScopeServiceRead}, nil)
 	ts := setupOptionalAuthRouter(t, plain)
 
 	for _, path := range []string{