refactor: split phase3.go + extract MCP tool registry (R4)

internal/httpapi/phase3.go (2627 lines, 12+ resource domains) split into
15 per-resource files:
- actuator.go: SSH execution machinery (initSSH, sshExec, resolveRunTarget,
  executeApprovedAction, jsonErr, gatewayPreflightPassed, resolveTemplate)
- checks.go, classifications.go, executions.go, approvals.go, patterns.go,
  skills.go, approval_rules.go, autonomy.go, risk_classes.go,
  relationships.go, entity_types.go, metrics.go, agent_activity.go,
  helpers.go — one file per resource domain, each with its own imports.

internal/mcp/server.go: newServer (708 lines, 33 inline tool registrations)
refactored to a registry pattern:
- internal/mcp/tools.go (new): toolReg struct + allTools() returning all 33
  tool definitions. Handler logic moved verbatim — no changes to tool names,
  descriptions, schemas, or behavior.
- server.go: newServer is now 9 lines (iterate registry, AddTool each).
  -699 lines.

No function logic, names, or signatures changed. go vet, build, and all
tests pass (httpapi, mcp, db, policy).

internal/httpapi/risk_classes.go

@@ -0,0 +1,33 @@
+package httpapi
+
+import (
+	"context"
+
+	"github.com/dtoro/oikos/internal/httpapi/gen"
+)
+
+// ─── Risk Classes ──────────────────────────────────────────────────────
+
+func (s *Server) ListRiskClasses(ctx context.Context, req gen.ListRiskClassesRequestObject) (gen.ListRiskClassesResponseObject, error) {
+	rows, err := s.pool.Query(ctx, `SELECT name, description, approval_required, autonomy_allowed FROM risk_classes ORDER BY name`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	items := []gen.RiskClass{}
+	for rows.Next() {
+		var rc gen.RiskClass
+		if err := rows.Scan(&rc.Name, &rc.Description, &rc.ApprovalRequired, &rc.AutonomyAllowed); err != nil {
+			return nil, err
+		}
+		items = append(items, rc)
+	}
+	if rows.Err() != nil {
+		return nil, rows.Err()
+	}
+	if items == nil {
+		items = []gen.RiskClass{}
+	}
+	return gen.ListRiskClasses200JSONResponse{Items: items}, nil
+}