Add admin-only Homebox MCP connector

Load an allowlisted subset of homebox-mcp tools (read + safe writes, no
deletes) over stdio and compile them into a separate admin agent, so
non-admins never see them. Each tool also re-checks is_admin per call.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -63,6 +63,8 @@ x-raggr-common: &raggr-common
     - CRON_SECRET=${CRON_SECRET}
     - CRONICLE_URL=${CRONICLE_URL:-http://cronicle:3012}
     - CRONICLE_API_KEY=${CRONICLE_API_KEY}
+    - HOMEBOX_URL=${HOMEBOX_URL}
+    - HOMEBOX_TOKEN=${HOMEBOX_TOKEN}
   depends_on:
     postgres:
       condition: service_healthy