Fresh provider sessions with browser or device access disabled were offered
preview_* and device_* tools that then failed on every call. Those
registrations now carry McpSchema.EnabledWhen, which reads the request's
McpInvocationContext, so tools/list and tools/call skip a capability the
credential does not grant. Handler checks stay in place.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>