fix: allow read-only CALL queries in axon_cypher

[bhattaraiprayag]

Why

axon_cypher currently rejects any query containing CALL, which blocks legitimate read-only procedure calls (for example CALL QUERY_FTS_INDEX(...)).

Scope

This PR makes one focused bug fix to axon_cypher read-only query gating and adds regression tests for that exact behavior.

What changed

• Updated src/axon/mcp/tools.py:
  • removed CALL from the write/admin keyword deny-list
  • kept write/admin keywords blocked (DELETE, DROP, CREATE, SET, REMOVE, MERGE, DETACH, INSTALL, LOAD, COPY)
  • clarified rejection text for disallowed operations
• Added regression tests in tests/mcp/test_tools.py:
  • allows read-only CALL QUERY_FTS_INDEX(...)
  • blocks CALL INSTALL ...
  • blocks CALL LOAD ...
  • blocks write-operation query (DETACH DELETE)

Validation

• uv run pytest -q tests/mcp/test_tools.py -> 48 passed
• uv run pytest -q -> 588 passed
• Runtime verification on sample repos:
  • axon analyze --no-embeddings succeeds for python/javascript/typescript
  • axon cypher "CALL QUERY_FTS_INDEX(...)" now returns results
  • axon cypher "CALL INSTALL EXTENSION fts" is still rejected

Closes #36

Checklist

• This PR is linked to a maintainer-approved issue (or is a trivial typo/link fix under 5 lines)
• I have read CONTRIBUTING.md
• One logical change only — no bundled/unrelated work
• Tests added or updated for this change
• pytest passes locally
• ruff check src/ tests/ passes
• I can explain every line of this PR when asked
• No generated project-config files (CLAUDE.md, .cursorrules, etc.)