feat(auth): split inventory scope out of server scope

Carve a new nezha:inventory:{read,delete,*} resource family out of
nezha:server:*. Listing and deleting servers/server-groups (GET /server,
/server-group, /ws/server, batch-delete/server[-group], MCP server.list)
now require nezha:inventory:*, while nezha:server:* covers per-server
runtime operations (get, exec, fs, config, metrics, batch-move,
force-update).

Also declare MCP tool OutputSchema for exec/fs/meta/server/transfer and
wrap server.list output in {servers,count} so strict MCP clients accept
the structured result. Correct the /file all-of scope entry and the stale
server:read documentation.

cmd/dashboard/controller/server.go

@@ -23,7 +23,7 @@ import (
 // @Security BearerAuth
 // @Security APITokenAuth
 // @Schemes
-// @Description List server. PAT scope required: nezha:server:read.
+// @Description List server. PAT scope required: nezha:inventory:read.
 // @Tags auth required
 // @Param id query uint false "Resource ID"
 // @Produce json