chore: remove dead MergeFfOnlyAsync, split AgentMcpTools into its own file, fix stale Zitadel doc

- GitService.MergeFfOnlyAsync had no callers anywhere in code; removed.
- AgentMcpTools moved out of LifecycleMcpTools.cs into External/AgentMcpTools.cs (no behavior change).
- Worker CLAUDE.md described ZitadelAuthProvider as a Phase 2 stub; it's fully implemented (OIDC discovery + refresh-token flow), updated both mentions.

src/ClaudeDo.Data/Git/GitService.cs

@@ -330,13 +330,6 @@ public sealed class GitService
             .Count(s => s.Length > 0);
     }
 
-    public async Task MergeFfOnlyAsync(string repoDir, string branchName, CancellationToken ct = default)
-    {
-        var (exitCode, _, stderr) = await RunGitAsync(repoDir, ["merge", "--ff-only", branchName], ct);
-        if (exitCode != 0)
-            throw new InvalidOperationException($"Fast-forward merge of '{branchName}' failed. Manual merge required. git stderr: {stderr}");
-    }
-
     private static async Task<(int ExitCode, string Stdout, string Stderr)> RunGitAsync(
         string workDir, IEnumerable<string> args, CancellationToken ct, string? stdinData = null, bool trimOutput = true)
     {