List a persona's owner-granted tools + the caller's own per-tool allow toggle

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.