Add _ALLOWED_LOG_PREFIXES allowlist check to log_tail (mirrors storage.py pattern) to prevent path traversal attacks. Move path/required guards before tool_error_handler context so validation errors raise cleanly. Add two tests: ToolError propagation and invalid path rejection.
Creates unraid_mcp/tools/live.py with SNAPSHOT_ACTIONS (9 one-shot reads) and COLLECT_ACTIONS (2 streaming collectors), plus tests/test_live.py with 6 passing tests. Registers register_live_tool in server.py, bringing the total to 12 tools.