feat(guards): wire elicitation into notifications/vm/rclone/settings/storage

Replace hard ToolError guard with gate_destructive_action() in 5 tools so
destructive actions prompt for interactive confirmation via MCP elicitation
when ctx is available, and still accept confirm=True as a bypass. Update
all test match strings from "destructive" to "not confirmed" accordingly.

tests/test_rclone.py

@@ -22,7 +22,7 @@ def _make_tool():
 class TestRcloneValidation:
     async def test_delete_requires_confirm(self) -> None:
         tool_fn = _make_tool()
-        with pytest.raises(ToolError, match="destructive"):
+        with pytest.raises(ToolError, match="not confirmed"):
             await tool_fn(action="delete_remote", name="gdrive")
 
     async def test_create_requires_fields(self) -> None: