feat(auth): split inventory scope out of server scope

Carve a new nezha:inventory:{read,delete,*} resource family out of
nezha:server:*. Listing and deleting servers/server-groups (GET /server,
/server-group, /ws/server, batch-delete/server[-group], MCP server.list)
now require nezha:inventory:*, while nezha:server:* covers per-server
runtime operations (get, exec, fs, config, metrics, batch-move,
force-update).

Also declare MCP tool OutputSchema for exec/fs/meta/server/transfer and
wrap server.list output in {servers,count} so strict MCP clients accept
the structured result. Correct the /file all-of scope entry and the stale
server:read documentation.

cmd/dashboard/controller/mcp_transfer.go

@@ -245,6 +245,7 @@ func init() {
 			},
 			"required": []string{"server_id", "path"},
 		},
+		OutputSchema:  transferURLOutputSchema(),
 		RequiredScope: model.ScopeServerRead,
 		Handler:       handleFsDownloadURL,
 	})
@@ -264,11 +265,24 @@ func init() {
 			},
 			"required": []string{"server_id", "path"},
 		},
+		OutputSchema:  transferURLOutputSchema(),
 		RequiredScope: model.ScopeServerWrite,
 		Handler:       handleFsUploadURL,
 	})
 }
 
+func transferURLOutputSchema() map[string]any {
+	return map[string]any{
+		"type": "object",
+		"properties": map[string]any{
+			"url":        map[string]any{"type": "string"},
+			"method":     map[string]any{"type": "string"},
+			"expires_at": map[string]any{"type": "string", "format": "date-time"},
+		},
+		"required": []string{"url", "method", "expires_at"},
+	}
+}
+
 func handleFsDownloadURL(c *gin.Context, raw json.RawMessage) (any, error) {
 	var args fsDownloadURLArgs
 	if err := decodeToolArgs(raw, &args); err != nil {