Fix agent-facing papercuts in the MCP tool surface

[usehoplite]

What and why

Audited the main user flows — the MCP tool calls and the guidance clients receive at handshake — and fixed the highest-impact papercuts, each verified with unit tests.

1. Handshake instructions contradicted the schema. with_instructions still told every MCP client to "pass an IAM Role ARN per call", "pass service_account_json", "pass app_key, app_secret, consumer_key per call", "pass api_token and account_id per call" — the pre-refactor credential-carrying design. None of those fields exist in the current tool schemas, so an agent that followed the instructions would hit schema errors on every call. Rewritten around the actual design (credentials from the server's environment, optional target.role_arn / target.project_ids selectors), extracted to a SERVER_INSTRUCTIONS constant, with a regression test asserting it names check_access and the environment and never mentions the removed per-call fields. Also fixed the tool descriptions and the GCP costs note that referenced the nonexistent credentials.gcp.billing_table → CLOUD_TOOLS_GCP_BILLING_TABLE (and the wrong env-var name CLOUD_GCP_BILLING_TABLE in src/clouds/gcp/billing.rs).

2. Inverted date ranges failed remotely with a confusing error. get_costs passed start_date/end_date straight to the provider; a swapped or equal range came back as the provider's own "invalid parameter" after the request had already travelled there. New checked_dates helper rejects malformed, equal, or inverted ranges locally and names both values in the error. Wiring: AWS service costs, AWS data_transfer, and GCP costs all use it now.

3. Cross-cloud summary turned API failures into clean zero bills. The OVH and Cloudflare arms ended in .unwrap_or_default(), so a 401 or quota error silently rendered as "total_billed_usd": 0 — exactly the "clean bill of health" failure this codebase's own doctrine warns about (see taken() in fetch_gcp_inventory). Both arms now use taken() and attach the failures to the provider row as errors, and the summary adds "partial": true when any provider row carries an error, so a partial result never reads as a zero. The GCP arm also keeps a failed analysis's error visible instead of dropping it.

4. Stale README counts. "the thirteen tools above" → "the tools above"; "All seven declare readOnlyHint" → "All eight".

5. Setup script records the Rust toolchain install (.hoplite/settings.json): fresh sandboxes run mise install rust@stable && mise use -g rust@stable so this Rust project can be built and tested out of the box.

Verification

• cargo test: 23 passed, 0 failed (including 3 new regression tests)
• cargo clippy --all-targets: clean
• cargo fmt --check: only two pre-existing drift files remain (in files this PR does not modify); all touched files are clean
• Rust 1.98.0 (stable)