Update MCP documentation

[mtesauro]

Description

Documentation-only change to the Pro MCP Server page, docs/content/metrics_reports/ai/mcp_server_pro.md (published at /metrics_reports/ai/mcp_server_pro/). No code, settings, or migrations.

The next DefectDojo Pro patch release ships the multi-toolset MCP Server: the existing /mcp endpoint is unchanged, and add-on toolsets are selected with a toolsets query parameter and switched on per instance under Settings → Feature Flags. This PR documents that release and, while in the file, fixes the tool reference, which had drifted from what the server actually serves.

New content:

• Enabling the MCP Server — the two places a superuser can switch it on (the MCP sidebar page and the MCP Server toggle under Settings → Feature Flags), that both control the same setting, and what a client sees while it is off.
• Toolsets section — what core is (everything /mcp has always served), how add-on toolsets are enabled (the MCP: Asset Hierarchy flag, which also needs the Asset Hierarchy feature), and that a toolset flag only changes what the MCP Server offers, never the REST API or the connecting token's permissions.
• Selecting toolsets in the connection URL — /mcp, /mcp?toolsets=hierarchy, /mcp?toolsets=all, with the note that all needs the Authorization header at connect time; the get_instance_info tool that reports version, enabled toolsets, flag states, and the Asset/Organization vs Product/Product Type naming; where the query string goes for each client type.
• When a connection is refused — the 400/401/403/503 plain-text responses, what each means, and what to do; plus behaviour when a flag is turned off mid-session.
• Reference Resources table — the six bundled JSON resources by name, URI, and contents (previously mentioned only in passing).
• A Troubleshooting entry for toolset '<name>' is not enabled on this DefectDojo Pro instance.

Corrections to existing content:

• Counts: the page said "12 available tools" in the Inspector section and "14 tools" in the reference heading. The core toolset serves 18 tools, 6 resources, and 2 prompts (19 tools when the URL carries a toolsets parameter, because get_instance_info is added). Both places now agree.
• Four tools that exist but were undocumented are added: get_product_by_id, get_product_type_by_id, get_engagement_by_id, get_test_by_id, with a note on walking Finding → Test → Engagement → Asset → Organization with direct calls.
• List-tool filters that exist but were described as "Same as get_products" are spelled out per tool: get_products (name, business_criticality, platform, lifecycle, external_audience, internet_accessible), get_engagements (product_id), get_tests (engagement_id), get_users (username, email, is_active, is_superuser), get_groups (name); get_product_types and get_roles take limit/offset only.
• get_dojo_group_members.group_id was documented as required; it is optional, and user_id is also accepted, so the tool can list a user's groups as well as a group's members.
• A pagination note covering the shared limit (1–1000, default 100) / offset (min 0) arguments and the single required ID on every *_by_id tool.

Terminology follows the page's existing convention of Asset / Organization as the primary names.

Test results

Docs-only; no unit tests apply. Verified by rendering the site locally from docs/:

npm ci
hugo --minify --gc --environment development

Build exits 0 and the page renders with the new sections, tables, and <details> blocks; existing anchors are unchanged and the new in-page link [Toolsets](#toolsets) resolves. Local Hugo was 0.163.x versus the 0.153.4 pinned in CI; the only warnings were pre-existing theme deprecation notices unrelated to this page.

The counts, tool names, argument names, ranges, and error texts were taken from the MCP Server build that ships with the same Pro patch release, and checked against a live Pro instance running that build (tools/list on /mcp and /mcp?toolsets=core, and each rejection status by connecting with an invalid selection).

Documentation

This PR is the documentation change. It is paired with a DefectDojo Pro change on the Pro bugfix line; both ship in the same patch release, which is why this targets bugfix rather than dev.

Checklist

• Based on the latest bugfix.
• Bugfix branch chosen deliberately: pairs with a Pro patch-release change.
• Meaningful PR name for release notes.
• No Python changes (Ruff / 3.13 compliance not applicable).
• Documentation updated as part of this PR.
• No model changes, no migrations.
• No unit tests applicable (docs only).
• Label docs applied.