feat: advertise WAF tools to API-key sessions

[ChiragAgg5k]

The WAF rule endpoints accept project API keys through the wafRules.read and wafRules.write scopes, but waf was missing from API_KEY_SERVICES, so API-key sessions never listed its 13 tools. Hosted OAuth sessions already list them.

Also runs ruff format on server.py, which main had left unformatted.

Until appwrite-console 0.9.0 ships, the WAF create/update tools type conditions as a string, because the spec declared it that way. appwrite/appwrite#14265 fixes the spec, and the console SDK pin bump will follow.

[hansi-codes]

🟢 Tier S · Ready to merge

The WAF service is already classified as project-scoped, and the catalog change is consistent with the stated API-key support.

Adds the WAF service to the API-key catalog, making its tools available to API-key sessions. Updates catalog coverage assertions for the additional service and tools, and reformats two lambdas in server.py.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 3

File	Change
src/mcp_server_appwrite/catalog_policy.py	Includes WAF among the services advertised to API-key sessions.
src/mcp_server_appwrite/server.py	Reformats existing lambdas without changing their behavior.
tests/unit/test_server.py	Updates API-key catalog counts and asserts WAF tools are present.

---

_{Reviewed 6d6ee00 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary