MCP token scoped to one team can drive a browser tab on another team

[andypalmi]

Problem

A third-party MCP token scoped to team A can list and pin the user's browser tab on team B, and then run platform_ui and flow_building tools in it.

Why

platform_list_browser_sessions and platform_set_active_browser_session return any of the user's tabs, and the MCP endpoint forwards the pinned tab without checking its team against the token. These tools run in the tab and never reach the REST API, so the token's team scope is never applied. Access is still limited to teams the user belongs to.

Passing session_id to an invoked tool also targets that tab while sending the pinned tab's entity.

Reproduce

1. Connect an MCP client with a token scoped to team A.
2. Open a FlowFuse tab on team B and turn on the MCP toggle.
3. platform_list_browser_sessions lists the team B tab, and platform_set_active_browser_session pins it.
4. ui_get_context (or flow_building_get_flow on an editor tab) runs against team B.

Expected

Tabs on teams outside the token's scope are not listed, can't be pinned, and can't be targeted by tool calls.