fix(mcp): resolve {{LIBRECHAT_USER_ID}} in loadTools' MCP tool-loading path (v0.8.7 port)

[inodb]

Port of #32 onto `v0.8.7-custom-v1`. Same fix as Foris's PR, adapted to the newer branch's test-file mock structure.

Change

One-line fix in `api/app/clients/tools/util/handleTools.js` line 454:

```diff

• const safeUser = createSafeUser(options.req?.user);

• const safeUser = createSafeUser(options.req?.user, user);
  ```

Same class of bug PRs #29/#30/#31 fixed elsewhere: `loadTools()` builds the MCP-tool `user` object from `options.req?.user` alone. When `req.user` is a plain object deserialized from the passport session (no `id` virtual, no `_id`), the resolver has nothing to work with — even though `loadTools` already receives the caller's resolved id via its own `user` param (see ToolService.js). Passing `user` as the fallback to `createSafeUser` closes the gap.

Test changes vs #32

Foris's version added `jest.mock('/config'...)` and `jest.mock('/server/services/MCP'...)` blocks. `v0.8.7-custom-v1` already has richer mock scaffolding at the top of the file (`mockGetServerConfig`, `mockCreateMCPTools`, etc.), so:

• Dropped Foris's duplicate mock blocks.
• Dropped his `require('/config')` + `require('/server/services/MCP')` imports.
• Rewrote the two regression tests to set up via `mockGetServerConfig` / `mockCreateMCPTools` and assert against `mockCreateMCPTools`.

Test intent + coverage are identical.

Test plan

• `npx jest app/clients/tools/util/handleTools.test.js` — 17/17 pass, including both new tests:
  • `loadTools MCP user id propagation > falls back to the loadTools user param when req.user has neither id nor _id`
  • `loadTools MCP user id propagation > prefers a resolvable req.user id over the loadTools user param`
• After merge + rebuild + rollout: send a chat via cBioChat (prod) that triggers an MCP tool call and confirm x-user-id in cbioagent-clickhouse-mcp logs is a real ObjectID rather than the raw `{{LIBRECHAT_USER_ID}}` placeholder.

Closes #32.