Tool allow/block lists per service

[rodaddy]

Configure which tools are exposed per service in services.json.

• allowTools: whitelist (only these tools available)
• blockTools: blacklist (all except these)
• Affects --help, schema, and invocation

Requirement: ADV-05

[rodaddy]

Already fully implemented. allowTools/blockTools glob patterns in services.json config, with checkToolAccess(), filterTools(), extractPolicy() wired into all call paths (schema, tool-call, service-help, daemon /call, generate-skills, auto-regen). Config schema validates via Zod. 216 lines of tests in tests/access/filter.test.ts.