security(mcp): reading the schema:// resource is not logged and its errors are not redacted #1775

Problem

`QueryaMcpServer._readSchema` (lib/core/mcp/querya_mcp_server.dart) bypasses `_guarded`: it never calls `_report`, so reading `schema://` is missing from the activity log, and an exception from `service.schemaOverview` reaches the MCP library as is, without `McpRedaction`, so a driver error quoting a connection string or an option list can reach the client.

Fix

Route the resource read through the same wrapper as the tools (activity record with tool `schema`, `McpToolException` for failures, redaction with the connection's secrets). Test: a failing driver error containing a password is masked; the call appears in `mcp_activity`.

Found in the MCP review.