refactor(guards): migrate array/keys/plugins to gate_destructive_action

Replace 7-11 line inline guard blocks in array.py, keys.py, and plugins.py
with single await gate_destructive_action(...) calls. Also fix guards.py to
raise unraid_mcp.core.exceptions.ToolError (project subclass) instead of
fastmcp.exceptions.ToolError so pytest.raises catches it correctly in tests.

unraid_mcp/tools/keys.py

@@ -11,7 +11,7 @@ from fastmcp import Context, FastMCP
 from ..config.logging import logger
 from ..core.client import make_graphql_request
 from ..core.exceptions import ToolError, tool_error_handler
-from ..core.guards import elicit_destructive_confirmation
+from ..core.guards import gate_destructive_action
 
 
 QUERIES: dict[str, str] = {
@@ -104,14 +104,13 @@ def register_keys_tool(mcp: FastMCP) -> None:
         if action not in ALL_ACTIONS:
             raise ToolError(f"Invalid action '{action}'. Must be one of: {sorted(ALL_ACTIONS)}")
 
-        if action in DESTRUCTIVE_ACTIONS and not confirm:
-            _desc = f"Delete API key **{key_id}**. Any clients using this key will lose access."
-            confirmed = await elicit_destructive_confirmation(ctx, action, _desc)
-            if not confirmed:
-                raise ToolError(
-                    f"Action '{action}' was not confirmed. "
-                    "Re-run with confirm=True to bypass elicitation."
-                )
+        await gate_destructive_action(
+            ctx,
+            action,
+            DESTRUCTIVE_ACTIONS,
+            confirm,
+            f"Delete API key **{key_id}**. Any clients using this key will lose access.",
+        )
 
         with tool_error_handler("keys", action, logger):
             logger.info(f"Executing unraid_keys action={action}")