First Phase-3 slice: dc3 tools list/call speak JSON-RPC to POST /mcp
with the same Bearer ticket as REST, reading the live tool catalog
instead of hard-coded paths. Requires an oauth-type login; classic
tickets get a clean exit-code-3 auth error. Five unit suites cover
request shaping, scope rejection, rpc errors and the 401 challenge.
