fix: address remaining PR review threads (docs, test-destructive, rclone test)

Resolves review threads:
- PRRT_kwDOO6Hdxs50T0Wp (test-destructive.sh: add key cleanup on failure path)
- PRRT_kwDOO6Hdxs50T0Ws (test-destructive.sh: pick last notification match by title)
- PRRT_kwDOO6Hdxs50T0Wt (README.md: correct test-actions.sh coverage description)
- PRRT_kwDOO6Hdxs50T0Wv (CLAUDE.md: add info.update_ssh to destructive actions list)
- PRRT_kwDOO6Hdxs50T0Wy (http_layer test: inp["config"] -> inp["parameters"])
- PRRT_kwDOO6Hdxs50T0Wz (DESTRUCTIVE_ACTIONS.md: key ID extraction key.id not top-level)
- PRRT_kwDOO6Hdxs50T0W2 (DESTRUCTIVE_ACTIONS.md: delete_archived — add archive step)
- PRRT_kwDOO6Hdxs50T0W3 (DESTRUCTIVE_ACTIONS.md: rclone params provider_type/config_data/name)
- PRRT_kwDOO6Hdxs50T0W4 (DESTRUCTIVE_ACTIONS.md: notification delete list+match pattern)
- PRRT_kwDOO6Hdxs50T0W5 (DESTRUCTIVE_ACTIONS.md: create_folder uses folder_name param)
- PRRT_kwDOO6Hdxs50T0W7 (README.md: cleanup note — test-tools.sh may write tmp log file)

Changes:
- test-destructive.sh keys test: attempt key delete cleanup when delete step fails
- test-destructive.sh notifications test: reverse list to pick most-recent title match
- tests/mcporter/README.md: accurate coverage claim; accurate cleanup section
- CLAUDE.md: info.update_ssh added to destructive actions list
- tests/http_layer/test_request_construction.py: assert parameters not config field
- docs/DESTRUCTIVE_ACTIONS.md: all 5 example code blocks corrected with right
  parameter names, correct ID extraction paths, and proper sequencing

Co-authored-by: Claude <noreply@anthropic.com>

tests/http_layer/test_request_construction.py

@@ -1044,7 +1044,7 @@ class TestRCloneToolRequests:
         inp = body["variables"]["input"]
         assert inp["name"] == "my-s3"
         assert inp["type"] == "s3"
-        assert inp["config"] == {"bucket": "my-bucket"}
+        assert inp["parameters"] == {"bucket": "my-bucket"}
 
     @respx.mock
     async def test_delete_remote_requires_confirm(self) -> None:

tests/mcporter/README.md

@@ -33,7 +33,7 @@ Launches `uv run unraid-mcp-server` in stdio mode for each tool call. Requires `
 UNRAID_MCP_URL=http://10.1.0.2:6970/mcp ./tests/mcporter/test-actions.sh
 ```
 
-Connects to an already-running streamable-http server. More up-to-date coverage — includes `unraid_settings`, all docker organizer mutations, and the full notification action set.
+Connects to an already-running streamable-http server. Covers all read-only actions across 10 tools (`unraid_settings` is all-mutations and skipped; all destructive mutations are explicitly skipped).
 
 ---
 
@@ -148,4 +148,4 @@ uv run unraid-mcp-server
 
 ## Cleanup
 
-Both scripts create **no temporary files and no background processes**. `test-actions.sh` connects to an existing server and leaves it running. `test-tools.sh` spawns stdio server subprocesses per call; they exit when mcporter finishes each invocation.
+`test-actions.sh` connects to an existing server and leaves it running; it creates no temporary files. `test-tools.sh` spawns stdio server subprocesses per call — they exit when mcporter finishes each invocation — and may write a timestamped log file under `${TMPDIR:-/tmp}`. Neither script leaves background processes.

tests/mcporter/test-destructive.sh

@@ -158,15 +158,17 @@ test_notifications_delete() {
     return
   fi
 
-  # The create response ID doesn't match the stored filename — list and find by title
+  # The create response ID doesn't match the stored filename — list and find by title.
+  # Use the LAST match so a stale notification with the same title is bypassed.
   local list_raw nid
   list_raw="$(mcall unraid_notifications '{"action":"list","notification_type":"UNREAD"}')"
   nid="$(python3 -c "
 import json,sys
 d = json.loads('''${list_raw}''')
 notifs = d.get('notifications', [])
-match = next((n['id'] for n in notifs if n.get('title') == 'mcp-test-delete'), '')
-print(match)
+# Reverse so the most-recent match wins over any stale leftover
+matches = [n['id'] for n in reversed(notifs) if n.get('title') == 'mcp-test-delete']
+print(matches[0] if matches else '')
 " 2>/dev/null)"
 
   if [[ -z "${nid}" ]]; then
@@ -255,7 +257,9 @@ sys.exit(1 if any(k.get('name') == 'mcp test key' for k in keys) else 0)
   success="$(python3 -c "import json,sys; d=json.loads('''${del_raw}'''); print(d.get('success', False))" 2>/dev/null)"
 
   if [[ "${success}" != "True" ]]; then
-    fail_test "${label}" "delete did not return success=true: ${del_raw}"
+    # Cleanup: attempt to delete the leaked key so future runs are not blocked
+    mcall unraid_keys "{\"action\":\"delete\",\"key_id\":\"${kid}\",\"confirm\":true}" &>/dev/null || true
+    fail_test "${label}" "delete did not return success=true: ${del_raw} (key delete re-attempted as fallback cleanup)"
     return
   fi