feat(guards): wire elicitation into notifications/vm/rclone/settings/storage

Replace hard ToolError guard with gate_destructive_action() in 5 tools so
destructive actions prompt for interactive confirmation via MCP elicitation
when ctx is available, and still accept confirm=True as a bypass. Update
all test match strings from "destructive" to "not confirmed" accordingly.

tests/test_vm.py

@@ -31,7 +31,7 @@ class TestVmValidation:
     async def test_destructive_actions_require_confirm(self, _mock_graphql: AsyncMock) -> None:
         tool_fn = _make_tool()
         for action in ("force_stop", "reset"):
-            with pytest.raises(ToolError, match="destructive"):
+            with pytest.raises(ToolError, match="not confirmed"):
                 await tool_fn(action=action, vm_id="uuid-1")
 
     async def test_destructive_vm_id_check_before_confirm(self, _mock_graphql: AsyncMock) -> None: