Expose team creation with explicit visibility through MCP

MCP exposes team listing and moving tasks between teams, but no team-creation operation. This blocks an authorized workflow that creates a private team and moves existing issues into it without a separate browser session.

Add an MCP tool for creating a team using the existing workspace/team application service. Accept workspace, name and key; support explicit private visibility and return the created ID, key, name and authoritative visibility. Preserve existing authorization and workspace isolation. Do not require agents to extract credentials or use database writes as a workaround.

Acceptance:

• An authorized MCP caller can create a private team and confirm visibility through tasklie_list_groups.
• Team keys/names receive the same validation and duplicate handling as the supported API/UI; retries do not silently create duplicate teams.
• Unauthorized callers and cross-workspace requests cannot create or expose teams.
• Tool schema documents defaults and visibility semantics; private creation does not transiently publish issues.
• Tests cover successful private creation, validation/duplicate failures and authorization boundaries.

Related: PAR-504 exposed read-only team visibility and is already Done; this is the separate creation capability. Requested by ParadauxIO in Discord message 1563111082749468814. Scope is the MCP capability, not automatic migration of existing issues or unrelated membership changes.